CVE-2026-118748: ASP.NET Core Denial of Service Vulnerability

For enterprise administrators, DevOps teams, and Windows developers testing or deploying early builds, this Microsoft security patch is straightforward to apply—provided you catch both your server runtimes and your integrated development environments. Below is a complete breakdown of the official MSRC telemetry, what the underlying weakness means in real-world web architecture, and how to bring every affected system up to a patched release.

Official Advisory Breakdown and Threat Telemetry​

According to the official MSRC update guide and Visual Studio release notes, the core advisory fact is concise and direct: ASP.NET Core Denial of Service Vulnerability: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Rather than requiring stolen credentials, local shell access, or social engineering, the vulnerability exposes network-accessible ASP.NET Core workloads directly. Let's look at the complete set of official metrics and status indicators published by Microsoft:

• CVE Identifier: CVE-2026-118748
• Vulnerability Title: ASP.NET Core Denial of Service Vulnerability
• Severity: Important
• CVSS Base Score: 7.5
• CVSS Temporal Score: 6.5
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-770
• Official Description: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Decoding the CVSS Vector and CWE-770​

Synthesizing from general industry knowledge of the Common Vulnerability Scoring System (CVSS) and Common Weakness Enumeration (CWE) standards, the vector string tells a very clear story for defenders prioritizing their patch queues.

First, examine the exploitability metrics: Attack Vector is Network (AV:N), Attack Complexity is Low (AC:L), Privileges Required is None (PR:N), and User Interaction is None (UI:N). In plain English, if an affected ASP.NET Core listener is reachable over a network, an unauthorized caller does not need a valid login token, special race-condition timing, or an administrator clicking a rogue prompt to trigger the flaw.

Second, examine the impact metrics: Scope is Unchanged (S:U), Confidentiality is None (C:N), Integrity is None (I:N), and Availability is High (A:H). This is a pure availability hazard. An attacker cannot use CVE-2026-118748 to read confidential database records or alter application memory, which is why Microsoft rates the overall severity Important rather than Critical. However, High availability impact means the targeted service can suffer severe degradation or outright exhaustion until mitigated or restarted.

Why does the temporal score drop from 7.5 down to 6.5? The temporal vector segments (E:U/RL:O/RC:C) reflect unproven exploit maturity (E:U), the availability of an Official Fix (RL:O), and Confirmed report confidence (RC:C). Paired with Microsoft's Exploitation Less Likely assessment and the confirmed status indicators (Publicly disclosed: No and Exploited: No), security teams have breathing room to roll out updates methodically rather than triggering a midnight emergency change freeze—though Customer action required: Yes makes it clear the exposure will not resolve itself automatically without updating to the fixed builds.

Section Summary: CVE-2026-118748 is an Important, network-exploitable denial-of-service flaw (CWE-770) with a 7.5 base score and 6.5 temporal score. It requires no authentication or user interaction, threatens service availability exclusively, shows no current public disclosure or active exploitation, and requires administrators and developers to apply official updates.

Why Unthrottled Resource Allocation Matters in Web Frameworks​

What actually happens under the hood when a web framework exhibits CWE-770—allocation of resources without limits or throttling? Drawing from general software engineering and cybersecurity principles, every modern web server operates on a finite budget of memory buffers, CPU cycles, file descriptors, and thread-pool workers. When incoming network traffic causes an application framework to allocate memory structures or processing queues proportionally to untrusted input without enforcing strict upper ceilings, an asymmetric bottleneck emerges.

Think of a restaurant host who lets a single caller reserve an infinite number of tables without putting down a deposit. Even if no food is stolen from the kitchen, legitimate paying customers are locked out on the sidewalk because every seat in the house is tied up on paper. In an ASP.NET Core deployment, asymmetric resource exhaustion means an attacker expends minimal bandwidth sending crafted network requests while forcing the receiving host to commit disproportionate system resources.

Consider two practical operational scenarios where this class of vulnerability creates headaches for IT teams:

1. Public-Facing API Gateways and Microservices: Organizations running containerized or virtualized workloads across Linux and Windows nodes often rely on horizontal autoscaling. If an unthrottled resource allocation flaw is triggered across internet-facing endpoints, CPU or memory spikes can trick orchestrators into spinning up extra instances unnecessarily—turning a service availability problem into a cloud billing headache before hitting hard cluster quotas.
2. Developer Workstations and Staging Environments: Why is Microsoft Visual Studio 2026 version 18.12 included alongside the standalone .NET runtimes? Visual Studio bundles SDKs and local web-hosting components used to build, debug, and test ASP.NET Core applications. Leaving developer toolchains on pre-fix builds risks reintroducing vulnerable components into build pipelines or exposing local debugging listeners on shared corporate networks.

Is an upstream web application firewall (WAF) or edge rate-limiter enough to ignore a runtime patch? While general network defense-in-depth—such as reverse-proxy connection throttling and request-size caps—is always smart architecture, edge appliances rarely inspect every nuance of how an application runtime allocates internal resources per request. Applying the vendor's fixed runtime build addresses the root cause directly inside ASP.NET Core.

Section Summary: CWE-770 vulnerabilities allow low-cost network traffic to exhaust finite host resources. Because ASP.NET Core spans production servers on Windows, Linux, and macOS as well as local development environments in Visual Studio, organizations must patch both hosting infrastructure and developer workstations rather than relying solely on perimeter rate-limiting.

Affected Products, Fixed Builds, and Remediation Matrix​

Microsoft's advisory covers four distinct product entries across server, desktop, and developer platforms. Because Customer action required: Yes applies across the board, administrators should inventory both cross-platform runtime installations and Visual Studio deployments to ensure every instance reaches its designated vendor fixed version.

Notice the version symmetry here: for .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, and .NET 11.0 installed on Windows, the fixed build is 11.0.0. That indicates any pre-release, preview, or release-candidate installations prior to 11.0.0 carry the vulnerability and must be upgraded to the 11.0.0 build or newer. Likewise, Microsoft Visual Studio 2026 version 18.12 reaches remediation at fixed build 18.12.0.

Step-by-Step Action Plan for IT Admins and Developers​

Based on standard Windows and cross-platform administration practices, teams can verify and remediate exposed assets systematically without disrupting production workflows:

1. Audit Installed .NET Runtimes and SDKs: On Windows, Linux, and Mac OS endpoints, query installed .NET builds using standard command-line inventory scripts or endpoint management tools to identify any .NET 11.0 installations running below build 11.0.0. Don't forget CI/CD build agents, container base images, and developer laptops where pre-release SDKs frequently linger after testing cycles.
2. Apply the .NET 11.0 Fixed Build: Follow Microsoft's exact remediation path for each operating system:
   • For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later.
   • For .NET 11.0 installed on Linux, update to fixed build 11.0.0 or later.
   • For .NET 11.0 installed on Mac OS, update to fixed build 11.0.0 or later.
3. Update Visual Studio Workstations: Check engineering machines and build servers running Microsoft Visual Studio 2026 version 18.12 via the Visual Studio Installer or enterprise endpoint configuration policies. For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
4. Rebuild Self-Contained Deployments and Containers: Synthesizing from general .NET deployment architecture, remember that framework-dependent apps pick up host runtime updates once the server restarts, whereas self-contained executables and container images bundle their own runtime binaries. If any staging or production services were packaged as self-contained builds prior to 11.0.0, recompile and redeploy them against fixed build 11.0.0 or later, then recycle your application pools or container pods so the updated binaries load into active memory.

If you are tracking broader patch cycles across your environment, check out related WindowsForum discussions on enterprise patch management, Windows Server hardening, and Visual Studio maintenance workflows to keep your deployment rings running smoothly.

Section Summary: Remediating CVE-2026-118748 requires bringing .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, and .NET 11.0 installed on Windows up to fixed build 11.0.0 or later, and updating Microsoft Visual Studio 2026 version 18.12 to fixed build 18.12.0 or later—followed by restarting host processes and rebuilding any self-contained packages that bundled older pre-fix runtimes.