ASP.NET Core Elevation of Privilege Vulnerability

Severity

Important

CVSS base score

Not published

Impact

Elevation of Privilege

EPSS, next 30 days

Not scored yet

Public exploit code

No Nuclei template lists it

Exploitability

Exploitation Less Likely

Publicly disclosed

No

Customer action

Required: apply the update

Component

ASP.NET Core

Weakness

CWE-276: Incorrect Default Permissions

Issued by

Microsoft

Published

25 Oct 2026 · October 2026

Last revised

25 Oct 2026

1. 25 Oct 2026 · 19:05:13 UTC Updates that fix itKB5133964: .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Windows (restart required); KB5133965: .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, .NET 9.0 installed on Windows, Microsoft Edge (Chromium-based) (restart required); KB5133966: .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, Microsoft Edge (Chromium-based) (restart required) → KB5133964: .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Windows (restart required); KB5133965: .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, .NET 9.0 installed on Windows, ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) (restart required); KB5133966: .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, .NET source-build Linux tarballs (all archive types) (restart required)
2. 25 Oct 2026 · 19:05:13 UTC Affected products.NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, .NET 11.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Windows, .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, .NET 9.0 installed on Windows, Microsoft Edge (Chromium-based) → .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS, .NET 11.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Windows, .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, .NET 9.0 installed on Windows, .NET source-build Linux tarballs (all archive types), ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)

The most recent 100 field changes are listed. Complete recorded revisions are kept separately.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.