Zero Radar
← feed
HighVulnerabilityCVE-2026-114148updated 30 Oct 2026, 10:50 UTC

ASP.NET Core local privilege escalation via incorrect default file permissions

Someone who already has a login on the same machine could gain higher rights than they should. Attackers who reach a low-privilege account can use this to take full control of that system.

Fix available · out Official, 4 sources
SeverityHighCVSS 7.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesSecurity updates as published by Microsoft MSRC and Ubuntu USN-8958-1; specific fixed versions are not stated in the provided material. · since 30 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

What happened

Incorrect default permissions in ASP.NET Core (and file ownership handling in .NET) let an authorized local user elevate their privileges.

Why it is dangerous: A local user or compromised low-privilege account could become administrator or root on the affected machine, exposing all data and services on it.

Are you affected?

You are affected if you run ASP.NET Core / .NET on Windows or Linux (Ubuntu dotnet packages) with multiple users or untrusted local accounts on the same host.

Microsoft ASP.NET Core (Windows); .NET packages on Ubuntu as listed in USN-8958-1 (versions not specified in the provided material).

What to do

  1. Install the latest Microsoft security update for ASP.NET Core and .NET
  2. On Ubuntu, apply the updates from USN-8958-1 (dotnet packages)
  3. Restart services and applications that use .NET after patching
  4. Limit local accounts on servers to those that are necessary

Timeline

  1. 25 Oct 2026, 14:00 UTC
    Publicly disclosed
  2. 25 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 25 Oct 2026, 17:03 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 16:20 UTC
    NVD reported on it · NVD
  5. 29 Oct 2026, 20:46 UTC
    Ubuntu Security reported on it · Ubuntu Security
  6. 30 Oct 2026, 10:50 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  7. 30 Oct 2026, 10:50 UTC
    Fix: Security updates as published by Microsoft MSRC and Ubuntu USN-8958-1; specific fixed versions are not stated in the provided material.

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114148
CVSS
7.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
25 Oct 2026, 14:00 UTC
On Zero Radar
25 Oct 2026, 17:03 UTC (3 h after disclosure)
Last change
30 Oct 2026, 10:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ASP.NET Core local privilege escalation via incorrect default file permissions · Zero Radar