ASP.NET Core Elevation of Privilege Vulnerability
Why It Matters
Analysis dossierWhy It Matters
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
High
No
Unknown
Risk basis: Microsoft or Microsoft-managed product relevance; HIGH severity; No confirmed exploitation signal in current enrichment
Affected Products & Remediation
6 source-backed products- Microsoft Visual Studio 2022 version 17.14 · version range not provided by source · Microsoft MSRC · Source
- ASP.NET Core 10.0 · version range not provided by source · Microsoft MSRC · Source
- ASP.NET Core 8.0 · version range not provided by source · Microsoft MSRC · Source
- ASP.NET Core 9.0 · version range not provided by source · Microsoft MSRC · Source
- Microsoft Visual Studio 2026 version 18.10 · version range not provided by source · Microsoft MSRC · Source
- ASP.NET Core 11.0 · version range not provided by source · Microsoft MSRC · Source
Vendor or catalog guidance (source)
- Microsoft MSRC: Release Notes
- Microsoft MSRC: Install the security update KB5130036 listed by MSRC
- Microsoft MSRC: Install the security update KB5130034 listed by MSRC
- Microsoft MSRC: Install the security update KB5130035 listed by MSRC
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- No
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
No rule-based guidance for this vulnerability class
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- secure@microsoft.com
- Record status · verification
- UPDATED · Unknown
- CPE
- Unknown
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-70183"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc