CVE-2026-114155: .NET Elevation of Privilege Vulnerability

CVE-2026-114155 PUBLISHED CVSS 7.5 HIGH

.NET Elevation of Privilege Vulnerability

Reported by microsoft · Published November 10, 2026

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	.NET 10.0 installed on Linux	10.0.0
Microsoft	.NET 10.0 installed on Mac OS	10.0.0
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
Microsoft	Microsoft.DotNet.HotReload.Watch.Aspire	10.0.300
microsoft	.net_10.0_installed_on_linux	10.0.0
Microsoft	.NET 10.0 installed on Linux	10.0.0
microsoft	microsoft.dotnet.hotreload.watch.aspire	10.0.300
microsoft	.net_10.0_installed_on_mac_os	10.0.0
Microsoft	.NET 10.0 installed on Mac OS	10.0.0
Microsoft	Microsoft.DotNet.HotReload.Watch.Aspire	10.0.300
microsoft	.net_11.0_installed_on_mac_os	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
microsoft	.net_11.0_installed_on_linux	11.0.0-preview.1

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-114155
vulnetix vdb fixes CVE-2026-114155

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-114155/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart