CVE-2026-114148: 
ASP.NET Core vulnerability analysis and mitigation

CVE-2026-114148 is a privilege escalation vulnerability in ASP.NET Core caused by incorrect default permissions, allowing an authorized local attacker to elevate privileges. It was disclosed on October 25, 2026, as part of Microsoft's out-of-band (OOB) security update release. Affected products include .NET 8.0, 9.0, 10.0, and 11.0 across Windows, Linux, and macOS, as well as ASP.NET Core Runtime and Targeting-Pack Linux tarballs (Microsoft-published). The vulnerability is rated Medium severity by Feedly's CVSS category estimate (Microsoft MSRC, .NET Blog).

The root cause is incorrect default permissions within ASP.NET Core (CWE-276: Incorrect Default Permissions), which allows a locally authenticated attacker to exploit misconfigured permission settings to gain elevated privileges. The attack vector is local, requiring the attacker to already have some level of authorized access to the system. This vulnerability was addressed in the same OOB patch batch that also fixed a Brotli decoder flaw (CVE-2026-111497) affecting .NET and ASP.NET Core, suggesting the update addressed multiple permission and memory-safety issues simultaneously (Microsoft MSRC, .NET Blog, HackRead).

Successful exploitation allows an authorized local attacker to elevate their privileges on the affected system, potentially compromising application integrity and confidentiality. The vulnerability affects .NET 8.0, 9.0, 10.0, and 11.0 installations across all major platforms (Windows, Linux, macOS), broadening the attack surface considerably. While the impact is local in nature, privilege escalation can serve as a stepping stone for lateral movement or deeper system compromise in multi-user or shared hosting environments (Microsoft MSRC, Feedly).

As of the available data, no public proof-of-concept (PoC) exploit code has been identified for CVE-2026-114148, and there is no evidence of in-the-wild exploitation (Microsoft MSRC). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog based on current information. Exploitation requires local authenticated access, which limits the attack surface compared to remotely exploitable vulnerabilities. No threat actor attribution or EPSS score data is currently available for this CVE.

Microsoft released patches for CVE-2026-114148 on October 25, 2026, as part of an out-of-band security update covering .NET 8.0, 9.0, 10.0, and 11.0 on Windows, Linux, and macOS. Organizations should update to the patched versions of .NET and ASP.NET Core as soon as possible via standard update mechanisms (e.g., Windows Update, package managers, or direct download from Microsoft). For self-contained applications bundling the .NET runtime, recompilation and redeployment with the updated SDK/runtime is required, as framework-dependent deployments will benefit from runtime-level updates automatically (.NET Blog, Microsoft MSRC, GitHub Announcement).

Microsoft's OOB patch release addressing CVE-2026-114148 alongside the Brotli decoder flaw (CVE-2026-111497) generated notable coverage across security media and social platforms. Security outlets including HackRead, Infosecurity Magazine, CyberSecurityNews, and The Hacker News covered the emergency patch release, with particular focus on the Brotli flaw but noting the privilege escalation issue as part of the same update batch (HackRead, Infosecurity Magazine, The Hacker News). Community discussion on Mastodon and Bluesky highlighted the urgency of patching self-contained .NET applications, which require redeployment rather than automatic runtime updates (SecurityOnline).