CVE-2026-109481: ASP.NET Core Elevation of Privilege Vulnerability

CVE-2026-109481 PUBLISHED CVSS 7.5 HIGH

ASP.NET Core Elevation of Privilege Vulnerability

Reported by microsoft · Published November 10, 2026

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
.NET 11.0 installed on Mac OS	Microsoft	11.0.0

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Windows	11.0.0-preview.1
Microsoft	Microsoft Visual Studio 2026 version 18.12	18.12.0
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
microsoft	.net_11.0_installed_on_windows	11.0.0-preview.1
Microsoft	Microsoft Visual Studio 2026 version 18.12	18.12.0
microsoft	.net_11.0_installed_on_mac_os	11.0.0-preview.1
microsoft	.net_11.0_installed_on_linux	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Windows	11.0.0-preview.1
microsoft	microsoft_visual_studio_2026_version_18.12	18.12.0

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-109481
vulnetix vdb fixes CVE-2026-109481

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-109481/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart