The remediation is explicit: For Aspire.Cli, update to fixed build 13.6.5 or later.
What the vulnerability exposes
Microsoft’s advisory describes the issue as “.NET Aspire Information Disclosure Vulnerability: Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.”
The important detail is what those logs can contain. According to the Microsoft Security Response Center, successful exploitation could reveal another user’s configuration information, including credentials stored in that configuration. The exposure occurs through diagnostic logs on a shared computer.
That makes this a local information-disclosure issue, rather than a vulnerability described as directly exploitable over a network. An authorized attacker is part of the stated attack scenario. For teams sharing development machines, the practical concern is that diagnostic output can cross a confidentiality boundary: information belonging to one user becomes accessible to another.
Severity, scores, and exploitation assessment
Microsoft supplies the following assessment:
| Field | Official value |
|---|---|
| CVE | CVE-2026-120792 |
| Exact title | Aspire Information Disclosure Vulnerability |
| Severity | Important |
| CVSS base score | 7.3 |
| CVSS temporal score | 6.4 |
| Weakness | CWE-532 |
| Exploitation assessment | Exploitation Less Likely |
The complete supplied CVSS vector is:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:U/RL:O/RC:C
Its base metrics describe a local attack, low attack complexity, low privileges required, and required user interaction, with changed scope. The assessed impact is high for confidentiality and low for integrity and availability.
Those metrics help explain the patching priority. The attack has prerequisites, but the potential disclosure includes credentials—not merely harmless troubleshooting chatter.
Microsoft’s supplied status fields are:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
“Exploitation Less Likely” is Microsoft’s assessment, not a reason to leave affected tooling unchanged.
Affected product and fixed build
| Affected product | Vendor fixed version / build |
|---|---|
| Aspire.Cli | 13.6.5 |
For Aspire.Cli, update to fixed build 13.6.5 or later.
The remediation names the CLI specifically. Administrators should therefore verify the deployed Aspire.Cli version rather than treating an unrelated operating-system or development-tool update as evidence that this issue has been addressed.
Practical steps for shared development computers
The following operational guidance follows from the advisory’s exposure mechanism; it is not an additional vendor-mandated procedure:
- Identify shared computers running Aspire.Cli. Give particular attention to machines used by multiple developers or support personnel.
- Apply the fixed release and verify the resulting version. The remediation target is 13.6.5 or later.
- Review diagnostic-log handling. Check who can read existing logs and whether those logs have been copied into shared troubleshooting locations.
- Investigate potential credential exposure. If a review identifies credentials accessible to unintended users, use the organization’s credential-replacement and incident-response processes.
Updating the CLI addresses the software vulnerability; it should not be treated as evidence that previously generated logs have been sanitized or exposed credentials have been replaced. That distinction matters whenever the vulnerable output is a persistent file.
Bottom line: prioritize the Aspire.Cli update on shared computers, then assess existing diagnostic data separately. The fix closes the software issue; careful log handling addresses the information it may already have left behind.