The practical concern is unauthorized access to data or operations exposed by that service. Successful exploitation requires winning a race condition, which Microsoft identifies as a high-complexity attack. Administrators should match each affected product branch to its corresponding fix rather than treat the advisory as a single, interchangeable update.
What the vulnerability allows
Microsoft describes the underlying issue as concurrent execution using a shared resource with improper synchronization—a race condition—in ASP.NET Core. An authorized attacker could exploit it to elevate privileges locally.
The official advisory also describes the issue under the wording “ASP.NET Core Elevation of Privilege Vulnerability.” That description and the security-feature-bypass title address the same security boundary: isolation intended to restrict an affected ASP.NET Core service to its own account.
According to Microsoft, an attacker with access to a local Windows account could bypass that isolation. Successful exploitation could allow the attacker to access data or perform operations exposed by the service without the intended authorization.
The distinction matters. This is a local attack scenario involving an existing account, not a description of an unauthenticated remote attack. The stated impact concerns the affected service’s data and operations; it should not be broadened into a claim of unrestricted control over the entire machine.
Severity, scores and exploitation assessment
Microsoft supplies the following assessment:
| Field | Microsoft assessment |
|---|---|
| Severity | Important |
| CVSS base score | 7.5 |
| CVSS temporal score | 6.5 |
| Weakness | CWE-362 |
| Exploitation assessment | Exploitation Less Likely |
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The supplied CVSS vector is:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
The vector describes local access, high attack complexity, low privileges, no required user interaction and changed scope. It assigns high confidentiality and integrity impact, with no availability impact in the scoring assessment.
Microsoft specifically explains AC:H: successful exploitation requires the attacker to win a race condition. In practical terms, the attack depends on a particular timing interaction rather than merely possessing a local account.
“Exploitation Less Likely” is Microsoft’s assessment, not a reason to leave affected installations unchanged. Customer action is required, and the advisory provides product-specific fixes.
Affected products and exact fixes
Microsoft’s affected-product information, support KB mappings and Visual Studio release information identify seven product entries. Apply the remediation corresponding to each installed branch:
- For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.15.
- For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later.
- For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.34.
- For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.23.
- For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.45 or later.
- For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
- For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
These are branch-specific destinations. In particular, the two listed Visual Studio branches have different fixed builds; administrators should retain that distinction in deployment and compliance records.
A practical patch-verification plan
The useful operational takeaway from Microsoft’s product matrix is to track .NET and Visual Studio as separate remediation checks. A record showing one product updated does not, by itself, establish that every other listed product on the machine has reached its required build.
For an affected estate:
- Inventory the listed product branches. Identify which affected .NET and Visual Studio entries are installed on each machine.
- Assign the corresponding remediation. Preserve the exact KB-to-build mappings for the three KB-linked .NET entries and the fixed-build targets for the remaining entries.
- Verify the result per product. Confirm the installed build against that product’s destination, rather than closing the machine’s remediation record after the first successful update.
- Validate service behavior. As an operational precaution, check that affected ASP.NET Core services still perform their intended functions after maintenance.
This workflow is a practical interpretation of the supplied fix matrix, not an additional Microsoft workaround.
Bottom line: CVE-2026-114157 concerns a local service-isolation boundary, with exploitation requiring a race-condition win. Microsoft rates it Important and requires customer action. The appropriate response is a branch-aware rollout followed by product-by-product verification—not a single “updated” checkbox for the whole machine.