ASP.NET Core Elevation of Privilege Vulnerability

Summary

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Remediation

1. Inventory every Microsoft .NET 10.0 installed on Linux deployment, including staging.
2. Upgrade Microsoft .NET 10.0 installed on Linux to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148