The vulnerability allows an authorized attacker to elevate privileges locally through sensitive information included in sent data. For development and IT teams, the immediate task is to identify use of the affected components and update them—not treat this solely as a Windows operating-system patching exercise.
What Microsoft’s advisory says
Microsoft’s official advisory describes the issue as:
The weakness is classified as CWE-201, insertion of sensitive information into sent data. The security concern is therefore not simply that information is exposed: Microsoft identifies local privilege elevation as the resulting impact.
The advisory’s ratings and status fields are:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-120006 |
| Exact title | Aspire Elevation of Privilege Vulnerability |
| Severity | Important |
| CVSS base score | 7.5 |
| CVSS temporal score | 6.5 |
| Weakness | CWE-201 |
| Exploitation assessment | Exploitation Less Likely |
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
These disclosure and exploitation labels describe Microsoft’s advisory assessment; they should not be interpreted as a reason to leave affected components unchanged.
Understanding the attack requirements
Microsoft supplies the following complete CVSS vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Reading that vector provides useful context for prioritization:
- Local attack vector: This is assessed as a local attack rather than a directly network-exploitable flaw.
- High attack complexity: Successful exploitation depends on conditions beyond a straightforward, low-complexity attack.
- Low privileges required: An attacker needs an existing level of access.
- User interaction required: The assessed attack requires another user’s participation.
- Changed scope: The impact can cross the security authority boundary associated with the vulnerable component.
- High confidentiality, integrity and availability impact: The potential consequences are substantial if exploitation succeeds.
This explains the distinction between “Exploitation Less Likely” and a vulnerability that can safely be ignored. The prerequisites make exploitation harder; they do not erase the potential impact.
Affected products and fixed builds
Microsoft identifies these product-to-fixed-build mappings:
| Affected product | Vendor fixed build |
|---|---|
| Aspire.Hosting | 13.6.5 |
| Aspire.Hosting.AppHost | 13.6.5 |
The prescribed remediation is explicit:
- For Aspire.Hosting, update to fixed build 13.6.5 or later.
- For Aspire.Hosting.AppHost, update to fixed build 13.6.5 or later.
Practical guidance for development teams
As an operational follow-through, teams should check dependency declarations and resolved dependency records for both exact product names. Updating one entry is not a substitute for checking the other.
After applying the prescribed updates, verify that the resolved versions are 13.6.5 or later, then rebuild and test the affected projects through the normal release process. This verification matters because an intended dependency change and the version actually used by a build are not always the same thing.
The bottom line: CVE-2026-120006 requires a component-level update. Its local access requirements help explain Microsoft’s exploitation assessment, but the combination of privilege elevation and potentially high impact makes completing—and verifying—the update the appropriate response.