CVE-2026-114148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114148", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-10-20T21:56:39.316Z", "datePublished": "2026-10-29T15:21:47.615Z", "dateUpdated": "2026-11-10T20:47:20.122Z"}, "containers": {"cna": {"title": "ASP.NET Core Elevation of Privilege Vulnerability", "datePublic": "2026-10-25T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.427"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.427"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.427"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.320"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.320"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.320"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.403"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.403"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.403"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0-preview.1", "versionEndExcluding": "11.0.100-rc.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0-preview.1", "versionEndExcluding": "11.0.100-rc.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0-preview.1", "versionEndExcluding": "11.0.100-rc.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "9.0.22"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_source-build_linux_tarballs_all_archive_types:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.100", "versionEndExcluding": "10.0.403-servicing.26523.112"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0 installed on Linux", "versions": [{"version": "10.0.0", "lessThan": "10.0.403", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 10.0 installed on Mac OS", "versions": [{"version": "10.0.0", "lessThan": "10.0.403", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 10.0 installed on Windows", "versions": [{"version": "10.0.0", "lessThan": "10.0.403", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Linux", "versions": [{"version": "11.0.0-preview.1", "lessThan": "11.0.100-rc.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Mac OS", "versions": [{"version": "11.0.0-preview.1", "lessThan": "11.0.100-rc.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Windows", "versions": [{"version": "11.0.0-preview.1", "lessThan": "11.0.100-rc.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 installed on Linux", "versions": [{"version": "8.0.0", "lessThan": "8.0.427", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 installed on Mac OS", "versions": [{"version": "8.0.0", "lessThan": "8.0.427", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 installed on Windows", "versions": [{"version": "8.0.0", "lessThan": "8.0.427", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 installed on Linux", "versions": [{"version": "9.0.0", "lessThan": "9.0.320", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 installed on Mac OS", "versions": [{"version": "9.0.0", "lessThan": "9.0.320", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 installed on Windows", "versions": [{"version": "9.0.0", "lessThan": "9.0.320", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET source-build Linux tarballs (all archive types)", "versions": [{"version": "8.0.100", "lessThan": "10.0.403-servicing.26523.112", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)", "versions": [{"version": "8.0.0", "lessThan": "9.0.22", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-276: Incorrect Default Permissions", "lang": "en-US", "type": "CWE", "cweId": "CWE-276"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T20:47:20.122Z"}, "references": [{"name": "ASP.NET Core Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T13:38:21.442156Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T13:46:52.704Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T13:38:21.442156Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T13:42:45.547Z"}}], "cna": {"title": "ASP.NET Core Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0 installed on Linux", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.403", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 10.0 installed on Mac OS", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.403", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 10.0 installed on Windows", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.403", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Linux", "versions": [{"status": "affected", "version": "11.0.0-preview.1", "lessThan": "11.0.100-rc.3", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Mac OS", "versions": [{"status": "affected", "version": "11.0.0-preview.1", "lessThan": "11.0.100-rc.3", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Windows", "versions": [{"status": "affected", "version": "11.0.0-preview.1", "lessThan": "11.0.100-rc.3", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 installed on Linux", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.427", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 installed on Mac OS", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.427", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 installed on Windows", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.427", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 installed on Linux", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.320", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 installed on Mac OS", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.320", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 installed on Windows", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.320", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET source-build Linux tarballs (all archive types)", "versions": [{"status": "affected", "version": "8.0.100", "lessThan": "10.0.403-servicing.26523.112", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "9.0.22", "versionType": "custom"}]}], "datePublic": "2026-10-25T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "name": "ASP.NET Core Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276: Incorrect Default Permissions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.427", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.427", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.427", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.320", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.320", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.320", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.403", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.403", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.403", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.100-rc.3", "versionStartIncluding": "11.0.0-preview.1"}, {"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.100-rc.3", "versionStartIncluding": "11.0.0-preview.1"}, {"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.100-rc.3", "versionStartIncluding": "11.0.0-preview.1"}, {"criteria": "cpe:2.3:a:microsoft:asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.22", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_source-build_linux_tarballs_all_archive_types:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.403-servicing.26523.112", "versionStartIncluding": "8.0.100"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T20:47:20.122Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114148", "state": "PUBLISHED", "dateUpdated": "2026-11-10T20:47:20.122Z", "dateReserved": "2026-10-20T21:56:39.316Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-10-29T15:21:47.615Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": ".NET 10.0 installed on Linux", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.403", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 10.0 installed on Mac OS", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.403", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 10.0 installed on Windows", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.403", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 11.0 installed on Linux", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.100-rc.3", "status": "affected", "version": "11.0.0-preview.1", "versionType": "custom"}]}, {"product": ".NET 11.0 installed on Mac OS", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.100-rc.3", "status": "affected", "version": "11.0.0-preview.1", "versionType": "custom"}]}, {"product": ".NET 11.0 installed on Windows", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.100-rc.3", "status": "affected", "version": "11.0.0-preview.1", "versionType": "custom"}]}, {"product": ".NET 8.0 installed on Linux", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.427", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 8.0 installed on Mac OS", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.427", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 8.0 installed on Windows", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.427", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0 installed on Linux", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.320", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0 installed on Mac OS", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.320", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0 installed on Windows", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.320", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"product": ".NET source-build Linux tarballs (all archive types)", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.403-servicing.26523.112", "status": "affected", "version": "8.0.100", "versionType": "custom"}]}, {"product": "ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.22", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally."}], "id": "CVE-2026-114148", "lastModified": "2026-10-30T14:16:38.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114148", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T13:38:21.442156Z", "version": "2.0.3"}}]}, "published": "2026-10-29T16:17:58.693", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:91709", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "dotnet8-0-main-8.0.133-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-28T00:00:00Z"}], "bugzilla": {"description": "dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability", "id": "2562054", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562054"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "status": "verified"}, "cwe": "CWE-276", "details": ["Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.\nWhat privileges could be gained by an attacker who successfully exploited this vulnerability?\nAn attacker who successfully exploited this vulnerability could gain the highest privileges on the system."], "name": "CVE-2026-114148", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "dotnet10.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "dotnet9.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-23T17:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114148\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114148"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.403)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 10.0 installed on Linux", "source": "cna", "vendor": "Microsoft"}, "product": ".net_10.0_installed_on_linux", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.403)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 10.0 installed on Mac OS", "source": "cna", "vendor": "Microsoft"}, "product": ".net_10.0_installed_on_mac_os", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.403)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 10.0 installed on Windows", "source": "cna", "vendor": "Microsoft"}, "product": ".net_10.0_installed_on_windows", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-preview.1,11.0.100-rc.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 11.0 installed on Linux", "source": "cna", "vendor": "Microsoft"}, "product": ".net_11.0_installed_on_linux", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-preview.1,11.0.100-rc.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 11.0 installed on Mac OS", "source": "cna", "vendor": "Microsoft"}, "product": ".net_11.0_installed_on_mac_os", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-preview.1,11.0.100-rc.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 11.0 installed on Windows", "source": "cna", "vendor": "Microsoft"}, "product": ".net_11.0_installed_on_windows", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.427)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 8.0 installed on Linux", "source": "cna", "vendor": "Microsoft"}, "product": ".net_8.0_installed_on_linux", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.427)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 8.0 installed on Mac OS", "source": "cna", "vendor": "Microsoft"}, "product": ".net_8.0_installed_on_mac_os", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.427)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 8.0 installed on Windows", "source": "cna", "vendor": "Microsoft"}, "product": ".net_8.0_installed_on_windows", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.320)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 9.0 installed on Linux", "source": "cna", "vendor": "Microsoft"}, "product": ".net_9.0_installed_on_linux", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.320)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 9.0 installed on Mac OS", "source": "cna", "vendor": "Microsoft"}, "product": ".net_9.0_installed_on_mac_os", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.320)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET 9.0 installed on Windows", "source": "cna", "vendor": "Microsoft"}, "product": ".net_9.0_installed_on_windows", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.0.100,10.0.403-servicing.26523.112)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": ".NET source-build Linux tarballs (all archive types)", "source": "cna", "vendor": "Microsoft"}, "product": ".net_source-build_linux_tarballs_all_archive_types", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,9.0.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)", "source": "cna", "vendor": "Microsoft"}, "product": "asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published", "vendor": "microsoft"}], "created": "2026-10-29T18:30:14.424603+00:00", "updated": "2026-10-29T21:30:15.301863+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$.net_10.0_installed_on_linux", "microsoft$PRODUCT$.net_10.0_installed_on_mac_os", "microsoft$PRODUCT$.net_10.0_installed_on_windows", "microsoft$PRODUCT$.net_11.0_installed_on_linux", "microsoft$PRODUCT$.net_11.0_installed_on_mac_os", "microsoft$PRODUCT$.net_11.0_installed_on_windows", "microsoft$PRODUCT$.net_8.0_installed_on_linux", "microsoft$PRODUCT$.net_8.0_installed_on_mac_os", "microsoft$PRODUCT$.net_8.0_installed_on_windows", "microsoft$PRODUCT$.net_9.0_installed_on_linux", "microsoft$PRODUCT$.net_9.0_installed_on_mac_os", "microsoft$PRODUCT$.net_9.0_installed_on_windows", "microsoft$PRODUCT$.net_source-build_linux_tarballs_all_archive_types", "microsoft$PRODUCT$asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published"]}