CVE-2026-118741: ASP.NET Core Elevation of Privilege Vulnerability

Unlike runtime-only patches that magically heal an application the moment a server restarts, vulnerabilities tied to scaffolding tools and web project templates demand a closer look at both developer workstations and generated authentication codebases. Let us break down what MSRC has reported, how the attack mechanics operate, and which exact packages and fixed builds you need to deploy.

Advisory Snapshot and Official Status​

According to the official MSRC Security Update Guide entry for CVE-2026-118741, the core metrics and operational status indicators are as follows:

• CVE Identifier: CVE-2026-118741
• Title: ASP.NET Core Elevation of Privilege Vulnerability
• Severity: Important
• CVSS Base Score: 8.1
• CVSS Temporal Score: 7.1
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-640
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

Section Summary: CVE-2026-118741 carries a high-impact 8.1 base score under CWE-640, has not been publicly disclosed or exploited, is assessed as Exploitation Less Likely, and requires customer action to remediate.

How the Password Reset Account Takeover Works​

At the heart of CVE-2026-118741 is a classic mismatch between how an application's identity store normalizes or compares email strings and how real-world email infrastructure actually routes messages. MSRC summarizes the root problem concisely: improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

How could an attacker turn that flaw into a real-world compromise? According to Microsoft's official advisory details, an unauthenticated attacker could exploit CVE-2026-118741 by submitting a password reset request using a specially crafted email address that an affected application treats as equivalent to another user's account. If the attack succeeds, the attacker can take over the targeted account completely, and no user interaction is required (UI:N), nor are any prior privileges (PR:N) needed over a network (AV:N). Because an account takeover hands the attacker the keys to whatever confidentiality, integrity, and availability permissions that target account holds within the application Scope (S:U), all three impact metrics sit at High (C:H/I:H/A:H).

Why, then, does Microsoft assess this vulnerability as Exploitation Less Likely and assign High Attack Complexity (AC:H) in the CVSS vector? MSRC explains the exact constraint behind AC:H: successful exploitation requires the attacker to control a distinct email address that an affected application's account lookup treats as equivalent to the victim's address, while actual email messages are delivered to a different mailbox controlled by the attacker.

From a general software engineering perspective, this kind of discrepancy falls squarely into the territory of CWE-640 (weakness in password recovery mechanisms for forgotten passwords). When an account lookup routine matches a crafted input string to an existing user record, yet hands the unnormalized or differently interpreted input string—or an ambiguously matched address—to the outbound mail sender, the password reset token travels to the attacker's inbox instead of the legitimate account owner's mailbox. Pulling that off requires non-trivial alignment between the target's email address structure, the application's comparison behavior, and a deliverable external mailbox that the attacker can actually register and read. That high bar explains the AC:H rating, even though a successful hit yields full account takeover without the victim ever clicking a suspicious prompt.

Section Summary: An unauthenticated network attacker can trigger a zero-interaction account takeover via password reset if they control a distinct mailbox whose crafted address is treated as equivalent to a victim's account during lookup while routing recovery emails to the attacker's inbox.

Affected ASP.NET Core Scaffolding and Template Packages​

One of the most important practical takeaways from the MSRC dossier for CVE-2026-118741 is where the affected components live. Rather than listing a monolithic Windows OS binary, Microsoft's affected product list targets eight specific NuGet scaffolding tools, ASP.NET Core web project templates, and Visual Studio web code generation packages spanning the 8.0, 9.0, 10.0, 11.0, and 20.3.0 versioning tracks.

Here is the complete product-to-fixed-build mapping and official remediation guidance supplied by MSRC:

Notice how comprehensive that coverage is across active and upcoming development lines: project templates from Microsoft.DotNet.Web.ProjectTemplates.8.0 (8.0.34), Microsoft.DotNet.Web.ProjectTemplates.9.0 (9.0.23), Microsoft.DotNet.Web.ProjectTemplates.10.0 (10.0.15), and Microsoft.DotNet.Web.ProjectTemplates.11.0 (11.0.0) are all represented alongside the Microsoft.dotnet-scaffold (20.3.0) and Microsoft.dotnet-scaffold-aspnet (20.3.0) tooling, plus the multi-targeted Microsoft.VisualStudio.Web.CodeGeneration.Design and Microsoft.VisualStudio.Web.CodeGenerators.Mvc packages (8.0.24, 9.0.13, and 10.0.3).

Section Summary: Eight Microsoft scaffolding, project template, and Visual Studio MVC/design code generation packages require updates to their respective fixed builds (20.3.0, 8.0.34, 9.0.23, 10.0.15, 11.0.0, 8.0.24, 9.0.13, and 10.0.3).

Why Scaffolding Vulnerabilities Demand Developer Vigilance​

Why should IT leaders, DevSecOps engineers, and Windows developers treat template and code-generator advisories differently from ordinary library patches? Drawing from general industry knowledge of how .NET scaffolding and project templates work, these packages generate source files directly into a developer's repository when a new web project is created or when identity pages—such as forgot-password handlers—are scaffolded into an existing app.

Consider what happens if a development team updates Microsoft.VisualStudio.Web.CodeGeneration.Design and Microsoft.VisualStudio.Web.CodeGenerators.Mvc on their build agents today, but never inspects the authentication pages they scaffolded six months ago. Updating the template and generator packages ensures that newly created projects and newly scaffolded code receive the hardened logic. However, software teams that previously used older versions of Microsoft.dotnet-scaffold, Microsoft.dotnet-scaffold-aspnet, Microsoft.DotNet.Web.ProjectTemplates.8.0, Microsoft.DotNet.Web.ProjectTemplates.9.0, Microsoft.DotNet.Web.ProjectTemplates.10.0, Microsoft.DotNet.Web.ProjectTemplates.11.0, Microsoft.VisualStudio.Web.CodeGeneration.Design, or Microsoft.VisualStudio.Web.CodeGenerators.Mvc should also compare their existing password-reset code against the output produced by the patched builds.

Ask yourself a quick sanity-check question: when your web app processes a password reset submission, does it send the recovery link to the raw email string typed into the unauthenticated request form, or to the canonical, verified email address stored on the matched user record? In secure software design, outbound recovery messages should always target the persisted address associated with the resolved account record, never an unverified equivalent string supplied by an anonymous caller.

Practical Remediation Checklist for Development and IT Teams​

Because MSRC explicitly marks Customer action required: Yes for CVE-2026-118741, teams building or maintaining ASP.NET Core applications on Windows and cross-platform CI/CD runners should take a structured approach:

1. Inventory Installed Templates and Global/Local Tools: Audit developer machines, dev containers, and build servers for installed versions of Microsoft.dotnet-scaffold and Microsoft.dotnet-scaffold-aspnet, as well as installed .NET web project template packs across 8.0, 9.0, 10.0, and 11.0.
2. Apply All Official Package Updates: Follow Microsoft's exact remediation targets across your projects and toolchains:
   • For Microsoft.dotnet-scaffold, update to fixed build 20.3.0 or later.
   • For Microsoft.dotnet-scaffold-aspnet, update to fixed build 20.3.0 or later.
   • For Microsoft.DotNet.Web.ProjectTemplates.10.0, update to fixed build 10.0.15 or later.
   • For Microsoft.DotNet.Web.ProjectTemplates.11.0, update to fixed build 11.0.0 or later.
   • For Microsoft.DotNet.Web.ProjectTemplates.8.0, update to fixed build 8.0.34 or later.
   • For Microsoft.DotNet.Web.ProjectTemplates.9.0, update to fixed build 9.0.23 or later.
   • For Microsoft.VisualStudio.Web.CodeGeneration.Design, update to fixed build 10.0.3 or later; update to fixed build 8.0.24 or later; update to fixed build 9.0.13 or later.
   • For Microsoft.VisualStudio.Web.CodeGenerators.Mvc, update to fixed build 10.0.3 or later; update to fixed build 8.0.24 or later; update to fixed build 9.0.13 or later.
3. Review Previously Scaffolded Password Reset Handlers: Based on general DevSecOps best practices for code-generator fixes, generate a clean reference project or scaffolded password-reset flow using the updated fixed builds (20.3.0, 8.0.34, 9.0.23, 10.0.15, 11.0.0, 8.0.24, 9.0.13, or 10.0.3 as applicable to your target framework) and diff your production password-recovery code to ensure any inherited email lookup and delivery behavior matches the fixed implementation.
4. Update Internal Starter Kits and Golden Repositories: Many enterprise IT shops clone internal boilerplate repositories rather than invoking dotnet new from scratch. Make sure internal starter templates don't keep reintroducing pre-patch password reset code after NuGet feeds have been updated.

For readers tracking broader Microsoft security patches, Visual Studio tooling updates, and .NET application security discussions on WindowsForum.com, CVE-2026-118741 is a textbook reminder that supply-chain hygiene does not stop at runtime DLLs. Securing the templates and code generators that write your authentication plumbing is every bit as vital as patching the server OS underneath it.

Section Summary: Remediation starts by updating all eight affected scaffolding, template, and Visual Studio code-generation packages to their MSRC-specified fixed builds, followed by reviewing existing scaffolded password-reset code and internal boilerplate repositories so legacy projects do not retain vulnerable recovery logic.