Detections
Analytics
Security Update for Microsoft ASP.NET Core (November 2026)
critical Nessus Plugin ID 380357
Synopsis
The Microsoft ASP.NET Core installations on the remote host are affected by multiple vulnerabilities.Description
The Microsoft ASP.NET Core installations on the remote host are missing security updates. It is, therefore, affected by multiple vulnerabilities:- Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network. (CVE-2026-109476)
- Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-109478)
- Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
(CVE-2026-114146)
- Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-114147)
- Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-114149, CVE-2026-114154)
- Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally. (CVE-2026-114157)
- Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. (CVE-2026-118741)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update .NET Core, remove vulnerable packages and refer to vendor advisory.See Also
https://dotnet.microsoft.com/en-us/download/dotnet/10.0
https://dotnet.microsoft.com/en-us/download/dotnet/8.0
https://dotnet.microsoft.com/en-us/download/dotnet/9.0
https://support.microsoft.com/kb/5135241
https://support.microsoft.com/kb/5135242
https://support.microsoft.com/kb/5135243
http://www.nessus.org/u?0b43c7d5
http://www.nessus.org/u?1b6bea73
http://www.nessus.org/u?1d4bc5e3
http://www.nessus.org/u?2af9dc46
http://www.nessus.org/u?5b030a2d
http://www.nessus.org/u?71202a91
http://www.nessus.org/u?71a53e13
http://www.nessus.org/u?9d6a7c88
Plugin Details
Severity: Critical
ID: 380357
File Name: smb_nt_ms26_nov_aspdotnet_core.nasl
Version: 1.1
Type: Local
Agent: windows
Family: Windows
Published: 11/13/2026
Updated: 11/13/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 92.8
CVSS v2
Risk Factor: High
Base Score: 8.5
Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-114146
CVSS v3
Risk Factor: Critical
Base Score: 9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:microsoft:asp.net_core
Required KB Items: SMB/Registry/Enumerated, installed_sw/ASP .NET Core Windows
Patch Publication Date: 11/10/2026
Vulnerability Publication Date: 11/10/2026
Reference Information
CVE: CVE-2026-109476, CVE-2026-109478, CVE-2026-114146, CVE-2026-114147, CVE-2026-114149, CVE-2026-114154, CVE-2026-114157, CVE-2026-118741