ASP.NET Core security feature bypass via input validation

Severity: medium · CVSS 6.5 · Published 2026-11-10

ASP.NET Core, a framework for building web applications, contains an improper input validation flaw that allows an attacker to bypass security features. An attacker on the network could exploit this to circumvent protections intended to safeguard application integrity. This advisory has been withdrawn as a duplicate of another advisory.

Technologies: Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.5, published 10 November 2026.
Which products and versions are affected?
Microsoft Asp.Net Core >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148, ECOSYSTEM:introduced=11.0.0-preview.7.26381.103,last_affected=11.0.0-rc.3.26522.148.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run Microsoft Asp.Net Core or Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is caused by improper input validation in ASP.NET Core that allows unauthorized attackers to bypass a security feature over the network. The attack requires high attack complexity and results in low confidentiality impact but high integrity impact. A patch has not been released as this advisory is withdrawn and consolidated under a separate advisory.

Affected products

  • Microsoft ASP.NET Core >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148

Timeline

  • 2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.