CVE-2026-114155

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114155", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-10-20T21:56:39.317Z", "datePublished": "2026-11-10T18:19:16.288Z", "dateUpdated": "2026-11-12T21:46:29.403Z"}, "containers": {"cna": {"title": ".NET Elevation of Privilege Vulnerability", "datePublic": "2026-11-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:microsoft.dotnet.hotreload.watch.aspire:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.300", "versionEndExcluding": "11.0.100"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.404"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.404"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0-preview.1", "versionEndExcluding": "11.0.100"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0-preview.1", "versionEndExcluding": "11.0.100"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0 installed on Linux", "versions": [{"version": "10.0.0", "lessThan": "10.0.404", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 10.0 installed on Mac OS", "versions": [{"version": "10.0.0", "lessThan": "10.0.404", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Linux", "versions": [{"version": "11.0.0-preview.1", "lessThan": "11.0.100", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Mac OS", "versions": [{"version": "11.0.0-preview.1", "lessThan": "11.0.100", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft.DotNet.HotReload.Watch.Aspire", "platforms": ["Linux", "Mac OS"], "versions": [{"version": "10.0.300", "lessThan": "11.0.100", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en-US", "type": "CWE", "cweId": "CWE-367"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-12T21:46:29.403Z"}, "references": [{"name": ".NET Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114155"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-10T20:03:02.496538Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:09:28.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-10T20:03:02.496538Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:03:05.760Z"}}], "cna": {"title": ".NET Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0 installed on Linux", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.404", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 10.0 installed on Mac OS", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.404", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Linux", "versions": [{"status": "affected", "version": "11.0.0-preview.1", "lessThan": "11.0.100", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 installed on Mac OS", "versions": [{"status": "affected", "version": "11.0.0-preview.1", "lessThan": "11.0.100", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft.DotNet.HotReload.Watch.Aspire", "versions": [{"status": "affected", "version": "10.0.300", "lessThan": "11.0.100", "versionType": "custom"}], "platforms": ["Linux", "Mac OS"]}], "datePublic": "2026-11-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114155", "name": ".NET Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:microsoft.dotnet.hotreload.watch.aspire:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.100", "versionStartIncluding": "10.0.300"}, {"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.404", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.404", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.100", "versionStartIncluding": "11.0.0-preview.1"}, {"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.100", "versionStartIncluding": "11.0.0-preview.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T23:50:49.760Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114155", "state": "PUBLISHED", "dateUpdated": "2026-11-10T23:50:49.760Z", "dateReserved": "2026-10-20T21:56:39.317Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-11-10T18:19:16.288Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": ".NET 10.0 installed on Linux", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.404", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 10.0 installed on Mac OS", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.404", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 11.0 installed on Linux", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.100", "status": "affected", "version": "11.0.0-preview.1", "versionType": "custom"}]}, {"product": ".NET 11.0 installed on Mac OS", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.100", "status": "affected", "version": "11.0.0-preview.1", "versionType": "custom"}]}, {"platforms": ["Linux", "Mac OS"], "product": "Microsoft.DotNet.HotReload.Watch.Aspire", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.100", "status": "affected", "version": "10.0.300", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally."}], "id": "CVE-2026-114155", "lastModified": "2026-11-10T20:18:01.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 6.0, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114155", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T20:03:02.496538Z", "version": "2.0.3"}}]}, "published": "2026-11-10T19:19:08.783", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114155"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{"bugzilla": {"description": "dotnet10.0: dotnet11.0: .NET Elevation of Privilege Vulnerability", "id": "2569206", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569206"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C", "status": "draft"}, "cwe": "CWE-367", "details": ["Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.\nAccording to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?\nSuccessful exploitation of this vulnerability requires an attacker to win a race condition.\nWhat privileges could an attacker gain by successfully exploiting this vulnerability?\nAn attacker could execute code with the permissions of another user on the affected system. This could give the attacker access to data and resources available to that user."], "name": "CVE-2026-114155", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "dotnet10.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-10T17:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114155\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114155"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.404)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 10.0 installed on Linux", "source": "cna", "vendor": "Microsoft"}, "product": ".net_10.0_installed_on_linux", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.404)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 10.0 installed on Mac OS", "source": "cna", "vendor": "Microsoft"}, "product": ".net_10.0_installed_on_mac_os", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-preview.1,11.0.100)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 11.0 installed on Linux", "source": "cna", "vendor": "Microsoft"}, "product": ".net_11.0_installed_on_linux", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-preview.1,11.0.100)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 11.0 installed on Mac OS", "source": "cna", "vendor": "Microsoft"}, "product": ".net_11.0_installed_on_mac_os", "vendor": "microsoft"}, {"configurations": [{"platform": ["linux", "mac_os"], "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.300,11.0.100)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Microsoft.DotNet.HotReload.Watch.Aspire", "source": "cna", "vendor": "Microsoft"}, "product": "microsoft.dotnet.hotreload.watch.aspire", "vendor": "microsoft"}], "created": "2026-11-12T01:30:04.964422+00:00", "updated": "2026-11-13T05:30:15.704926+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$.net_10.0_installed_on_linux", "microsoft$PRODUCT$.net_10.0_installed_on_mac_os", "microsoft$PRODUCT$.net_11.0_installed_on_linux", "microsoft$PRODUCT$.net_11.0_installed_on_mac_os", "microsoft$PRODUCT$microsoft.dotnet.hotreload.watch.aspire"]}