Skip to content

CVE-2026-114146 ASP.NET Core Elevation of Privilege Vulnerability

CriticalCVSS 9.0
Published
Updated
Exploit status
No public exploit known

Description

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Affected products

ProductAffected versionsFixed in
microsoft.aspnetcore.http.connections < 1.2.14 1.2.14
Microsoft net 8.0 installed on windows < 8.0.34 8.0.34
Microsoft net 8.0 installed on linux < 8.0.34 8.0.34
Microsoft net 8.0 installed on mac os < 8.0.34 8.0.34
Microsoft net 9.0 installed on windows < 9.0.23 9.0.23
Microsoft net 9.0 installed on linux < 9.0.23 9.0.23
Microsoft net 9.0 installed on mac os < 9.0.23 9.0.23
Microsoft net 10.0 installed on windows < 10.0.15 10.0.15
Microsoft net 10.0 installed on linux < 10.0.15 10.0.15
Microsoft net 10.0 installed on mac os < 10.0.15 10.0.15
Microsoft net 11.0 installed on windows < 11.0.0 11.0.0
Microsoft net 11.0 installed on linux < 11.0.0 11.0.0
Microsoft net 11.0 installed on mac os < 11.0.0 11.0.0
Microsoft visual studio 2022 < 17.14.45 17.14.45
microsoft visual studio 2026 version 18.11 < 18.11.4 18.11.4
microsoft visual studio 2026 version 18.12 < 18.12.0 18.12.0
redhat/dotnet10.0(Red Hat:enterprise_linux:10) All versions No fix listed
redhat/dotnet11.0(Red Hat:enterprise_linux:10) All versions No fix listed
redhat/dotnet8.0(Red Hat:enterprise_linux:10) All versions No fix listed
redhat/dotnet9.0(Red Hat:enterprise_linux:10) All versions No fix listed
redhat/dotnet10.0(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/dotnet11.0(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/dotnet8.0(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/dotnet9.0(Red Hat:enterprise_linux:8) All versions No fix listed
redhat/dotnet10.0(Red Hat:enterprise_linux:9) All versions No fix listed
Show 175 more
redhat/dotnet11.0(Red Hat:enterprise_linux:9) All versions No fix listed
redhat/dotnet8.0(Red Hat:enterprise_linux:9) All versions No fix listed
redhat/dotnet9.0(Red Hat:enterprise_linux:9) All versions No fix listed
redhat/dotnet10.0(Red Hat:hummingbird:1) All versions No fix listed
redhat/dotnet8.0(Red Hat:hummingbird:1) All versions No fix listed
redhat/dotnet9.0(Red Hat:hummingbird:1) All versions No fix listed
Microsoft net 10.0 installed on linux >= 10.0.0, < 10.0.15 10.0.15
Microsoft net 10.0 installed on mac os >= 10.0.0, < 10.0.15 10.0.15
Microsoft net 10.0 installed on windows >= 10.0.0, < 10.0.15 10.0.15
Microsoft net 11.0 installed on linux >= 11.0.0-preview.1, < 11.0.0 11.0.0
Microsoft net 11.0 installed on mac os >= 11.0.0-preview.1, < 11.0.0 11.0.0
Microsoft net 11.0 installed on windows >= 11.0.0-preview.1, < 11.0.0 11.0.0
Microsoft net 8.0 installed on linux >= 8.0.0, < 8.0.34 8.0.34
Microsoft net 8.0 installed on mac os >= 8.0.0, < 8.0.34 8.0.34
Microsoft net 8.0 installed on windows >= 8.0.0, < 8.0.34 8.0.34
Microsoft net 9.0 installed on linux >= 9.0.0, < 9.0.23 9.0.23
Microsoft net 9.0 installed on mac os >= 9.0.0, < 9.0.23 9.0.23
Microsoft net 9.0 installed on windows >= 9.0.0, < 9.0.23 9.0.23
Microsoft Visual Studio 2022 version 17.14 >= 17.14.0, < 17.14.45 17.14.45
microsoft visual studio 2026 version 18.11 >= 18.11.0, < 18.11.4 18.11.4
microsoft visual studio 2026 version 18.12 >= 18.12.0, < 18.12.0 18.12.0
microsoft.aspnetcore.http.connections >= 1.2.0, < 1.2.14 1.2.14
nuget Microsoft.AspNetCore.Http.Connections(NuGet) >= 1.2.0, < 1.2.14 1.2.14
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.0 No fix listed
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.10 No fix listed
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.11 No fix listed
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.12 No fix listed
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.13 No fix listed
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.8 No fix listed
nuget Microsoft.AspNetCore.Http.Connections(NuGet) = 1.2.9 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.0 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.1 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.10 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.11 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.12 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.13 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.14 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.15 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.16 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.17 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.18 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.19 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.2 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.20 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.21 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.22 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.23 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.24 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.25 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.26 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.27 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.28 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.29 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.3 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.30 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.31 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.32 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.33 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.4 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.5 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.6 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.7 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet) = 8.0.8 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.0 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.1 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.10 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.11 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.12 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.13 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.14 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.15 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.16 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.17 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.18 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.19 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.2 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.20 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.21 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.22 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.23 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.24 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.25 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.26 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.27 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.28 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.29 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.3 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.30 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.31 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.32 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.33 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.4 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.5 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.6 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.7 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet) = 8.0.8 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.0 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.1 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.10 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.11 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.12 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.13 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.14 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.15 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.16 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.17 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.18 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.19 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.2 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.20 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.21 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.22 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.23 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.24 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.25 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.26 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.27 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.28 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.29 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.3 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.30 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.31 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.32 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.33 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.4 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.5 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.6 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.7 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet) = 8.0.8 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.0 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.1 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.10 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.11 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.12 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.13 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.14 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.15 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.16 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.17 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.18 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.19 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.2 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.20 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.21 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.22 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.23 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.24 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.25 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.26 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.27 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.28 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.29 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.3 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.30 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.31 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.32 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.33 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.4 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.5 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.6 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.7 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet) = 8.0.8 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.0 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.1 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.10 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.11 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.12 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.13 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.14 No fix listed
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet) = 8.0.15 No fix listed

References