# Microsoft Asp.net Core vulnerabilities Source: https://junglewise.ai/threats/technologies/asp-net-core Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/asp-net-core.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 38 vulnerabilities in Microsoft Asp.net Core: 18 in the last 7 days and 32 in the last 90 days, 5 of them critical and 1 exploited in the wild. The most recent, Microsoft ASP.NET Core race condition privilege escalation, was published on 10 November 2026. 11 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. ## Counts - Last 7 days: 18 - Last 30 days: 20 - Last 90 days: 32 - All time: 38 (5 critical, 1 exploited in the wild) ## About Microsoft Asp.net Core Microsoft framework for building web applications and services using .NET on multiple platforms. ## Latest Microsoft Asp.net Core vulnerabilities - [Microsoft ASP.NET Core race condition privilege escalation](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-security-04275796) (high, CVSS 7.5, published 10 Nov 2026) - [Microsoft ASP.NET Core denial of service via resource consumption](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-denial-of-0f1476a7) (high, CVSS 7.5, published 10 Nov 2026) - [ASP.NET Core security feature bypass via input validation](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-security-942d98c7) (medium, CVSS 6.5, published 10 Nov 2026) - [ASP.NET Core inefficient algorithmic complexity denial of service](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-denial-of-f3e14a11) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-118750: Microsoft ASP.NET Core denial of service via resource allocation](https://junglewise.ai/threats/cve-2026-118750-allocation-of-resources-without-limits-or-throttling-in-asp-net) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-118749: ASP.NET Core inefficient algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-118749-inefficient-algorithmic-complexity-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-118748: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-118748-allocation-of-resources-without-limits-or-throttling-in-asp-net) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-118741: ASP.NET Core improper authentication privilege elevation](https://junglewise.ai/threats/cve-2026-118741-improper-authentication-in-asp-net-core-allows-an-unauthorized) (high, CVSS 8.1, published 10 Nov 2026) - [CVE-2026-114157: Microsoft ASP.NET Core race condition privilege escalation](https://junglewise.ai/threats/cve-2026-114157-concurrent-execution-using-shared-resource-with-improper) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114156: ASP.NET Core input validation bypass allows security feature circumvention](https://junglewise.ai/threats/cve-2026-114156-improper-input-validation-in-asp-net-core-allows-an-unauthorized) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-114154: Microsoft ASP.NET Core denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-114154-uncontrolled-resource-consumption-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114150: ASP.NET Core information disclosure via uninitialized resource](https://junglewise.ai/threats/cve-2026-114150-use-of-uninitialized-resource-in-asp-net-core-allows-an) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-114149: Microsoft ASP.NET Core denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-114149-uncontrolled-resource-consumption-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114147: Microsoft ASP.NET Core memory leak denial of service](https://junglewise.ai/threats/cve-2026-114147-missing-release-of-memory-after-effective-lifetime-in-asp-net) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114146: Microsoft ASP.NET Core incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-114146-incorrect-authorization-in-asp-net-core-allows-an-authorized) (critical, CVSS 9, published 10 Nov 2026) - [CVE-2026-109481: Microsoft ASP.NET Core cross-site request forgery privilege escalation](https://junglewise.ai/threats/cve-2026-109481-cross-site-request-forgery-csrf-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-109478: ASP.NET Core algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-109478-inefficient-algorithmic-complexity-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-109476: Microsoft ASP.NET Core improper output encoding information disclosure](https://junglewise.ai/threats/cve-2026-109476-improper-encoding-or-escaping-of-output-in-asp-net-core-allows) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-114148: ASP.NET Core incorrect default permissions privilege escalation](https://junglewise.ai/threats/cve-2026-114148-incorrect-default-permissions-in-asp-net-core-allows-an) (high, CVSS 7.8, published 29 Oct 2026) - [CVE-2026-109468: Microsoft ASP.NET Core resource exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109468-allocation-of-resources-without-limits-or-throttling-in-asp-net) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-70186: ASP.NET Core Kestrel denial of service in HTTP/3 handling](https://junglewise.ai/threats/cve-2026-70186-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70188: Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-96236: Microsoft ASP.NET Core Localization denial of service](https://junglewise.ai/threats/cve-2026-96236-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70183: Microsoft ASP.NET Core authorization bypass in Blazor AuthorizeRouteView](https://junglewise.ai/threats/cve-2026-70183-microsoft-security-advisory-asp-net-core-security-feature-bypass) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader](https://junglewise.ai/threats/cve-2026-70196-microsoft-security-advisory-asp-net-core-denial-of-service) (medium, CVSS 5.9, published 13 Oct 2026) ## Most severe Microsoft Asp.net Core vulnerabilities - [CVE-2023-38180: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2023-38180-microsoft-net-core-and-visual-studio-denial-of-service) (critical, exploited in the wild, CVSS 3.1, published 9 Aug 2023) - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-70188: Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-40372: Microsoft ASP.NET Core privilege escalation via improper signature verification](https://junglewise.ai/threats/cve-2026-40372-microsoft-asp-net-core-privilege-escalation-via-improper) (critical, CVSS 9.1, published 21 Apr 2026) - [CVE-2026-114146: Microsoft ASP.NET Core incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-114146-incorrect-authorization-in-asp-net-core-allows-an-authorized) (critical, CVSS 9, published 10 Nov 2026) - [CVE-2026-102870: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code…](https://junglewise.ai/threats/cve-2026-102870-microsoft-security-advisory-asp-net-core-remote-code-execution) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-118741: ASP.NET Core improper authentication privilege elevation](https://junglewise.ai/threats/cve-2026-118741-improper-authentication-in-asp-net-core-allows-an-unauthorized) (high, CVSS 8.1, published 10 Nov 2026) - [CVE-2026-114148: ASP.NET Core incorrect default permissions privilege escalation](https://junglewise.ai/threats/cve-2026-114148-incorrect-default-permissions-in-asp-net-core-allows-an) (high, CVSS 7.8, published 29 Oct 2026) - [CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding](https://junglewise.ai/threats/cve-2022-38013-microsoft-net-stack-overflow-in-asp-net-core-model-binding) (high, CVSS 7.5, published 15 Sep 2022) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 3 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 10 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 18 | 1 | 0 | ## Other Microsoft technologies - [Microsoft Windows](https://junglewise.ai/threats/technologies/windows): 2,362 vulnerabilities - [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10): 589 vulnerabilities - [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2): 565 vulnerabilities - [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2): 534 vulnerabilities - [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025): 534 vulnerabilities - [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022): 528 vulnerabilities - [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019): 521 vulnerabilities - [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012): 517 vulnerabilities - [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11): 494 vulnerabilities - [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016): 476 vulnerabilities - [Microsoft Windows 10 1809](https://junglewise.ai/threats/technologies/windows-10-1809): 380 vulnerabilities - [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2): 373 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft Asp.net Core vulnerabilities", https://junglewise.ai/threats/technologies/asp-net-core, 13 November 2026.