External risk intelligence

ASP.NET Core Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-114146

This vulnerability involves ASP.NET Core, a framework commonly used to build web applications, APIs, and internet-facing services. Because these applications are frequently deployed as public-facing web endpoints to serve users or other services over the network, the vulnerable surface is commonly exposed to the internet in typical real-world deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects ASP.NET Core applications, which are often used for public-facing web services. It allows an authorized user to potentially gain higher privileges than intended, which could lead to unauthorized access or control over the affected systems. The primary concern at this stage is to determine if our organization utilizes this technology and, if so, to what extent it may be exposed.

Authorized users can gain extra access.
Affects common web application technology.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with some level of access could potentially exploit this vulnerability by leveraging an improper authorization flaw within ASP.NET Core. This could allow them to elevate their privileges, leading to unauthorized access and control over a network. The vulnerability can be triggered over a network connection, and it's unclear if user interaction is required.

Network access and some user privileges required.
Improper authorization in ASP.NET Core.
Privilege escalation leading to network control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in ASP.NET Core could allow an attacker who has already gained some level of access to elevate their privileges over a network, potentially impacting the integrity and availability of the affected service. The specific risks depend on how the ASP.NET Core application is configured and the sensitive operations it performs.

Authorized user data could be affected.
Privilege escalation may occur over network.
Service integrity and availability could be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ASP.NET Core, enabling privilege escalation over a network, likely impacts application owners and platform teams responsible for web services and APIs. The first practical step is to identify all deployed ASP.NET Core applications, confirm their network exposure, and assess their business criticality to prioritize remediation efforts and assign ownership.

Application owners should own the issue.
Verify network exposure and criticality first.
Plan remediation and coordinate with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ASP.NET Core and why is it used?

ASP.NET Core is a cross-platform, open-source framework developed by Microsoft to build modern, cloud-enabled web applications. Developers rely on it to create high-performance web services, APIs, and microservices that can be deployed on Windows, Linux, or macOS. It provides the essential infrastructure for managing HTTP requests and authenticating users, making it a foundational component for many public-facing internet services.

What does CVE-2026-114146 mean for security?

This vulnerability is classified as Incorrect Authorization (CWE-863). In plain terms, it means the software fails to correctly verify whether a user has permission to perform a specific action. Because of this weakness, an attacker who already has some level of access can bypass security checks to gain elevated privileges, allowing them to perform actions they should not be authorized to do within the system.

How can an attacker trigger this ASP.NET Core vulnerability?

An attacker needs to possess existing, lower-level access to the application to attempt privilege escalation over a network connection. Simply having public-facing web infrastructure does not automatically trigger the bug. The flaw specifically targets the internal authorization logic, meaning the attacker must be capable of interacting with the service's authenticated functions to exploit the misconfiguration.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is likely relevant to you because ASP.NET Core is frequently used for public-facing web endpoints. Since these services are often deployed to be accessible over the internet to serve users, the vulnerable surface area is commonly exposed. You should prioritize assessing any internet-facing applications that rely on this framework.

What should I do if I use ASP.NET Core?

Begin by creating an inventory of all applications within your environment that run on ASP.NET Core. Once identified, confirm which of these services are exposed to the network and determine their business criticality. Coordinate with your application owners to evaluate the potential impact and prepare for necessary security updates or configuration changes provided by the vendor.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114146

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.