Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-70183.md

Created October 13, 2026 20:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/d53a578a0f8f19f39ff618766fb7fe70 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/d53a578a0f8f19f39ff618766fb7fe70 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-70183: CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition - CVE Security Report
Raw
CVE-2026-70183.md

CVE-2026-70183: CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition

CVSS Score: 7.5 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70183

Summary

An elevation of privilege vulnerability exists in ASP.NET Core and Microsoft Visual Studio due to improper synchronization during concurrent thread execution. Authenticated remote attackers with low privileges can exploit a timing window to manipulate shared resources and assume higher-level execution contexts.

TL;DR

A race condition in ASP.NET Core allows authenticated low-privilege remote users to elevate privileges by sending high-frequency concurrent requests that hit unsynchronized shared memory structures.

Technical Details

  • CWE ID: CWE-362 (Race Condition)
  • Attack Vector: Network (AV:N)
  • Attack Complexity: High (AC:H)
  • Privileges Required: Low (PR:L)
  • CVSS v3.1 Score: 7.5 (High)
  • CISA KEV Status: Not Listed
  • Exploit Status: Unproven / No Public PoC
  • Impact: Elevation of Privilege (High C/I/A)

Affected Systems

  • ASP.NET Core 8.0 (< 8.0.32)
  • ASP.NET Core 9.0 (< 9.0.21)
  • ASP.NET Core 10.0 (< 10.0.13)
  • ASP.NET Core 11.0 (< 11.0.0-rc.2)
  • Microsoft Visual Studio 2022 v17.14 (< 17.14.42)
  • Microsoft Visual Studio 2026 v18.10 (< 18.10.4)
  • ASP.NET Core 8.0: < 8.0.32 (Fixed in: 8.0.32)
  • ASP.NET Core 9.0: < 9.0.21 (Fixed in: 9.0.21)
  • ASP.NET Core 10.0: < 10.0.13 (Fixed in: 10.0.13)
  • ASP.NET Core 11.0: < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
  • Microsoft Visual Studio 2022 (v17.14): 17.14.0 - < 17.14.42 (Fixed in: 17.14.42)
  • Microsoft Visual Studio 2026 (v18.10): 18.10.0 - < 18.10.4 (Fixed in: 18.10.4)

Mitigation

  • Apply vendor security patches for ASP.NET Core and Microsoft Visual Studio immediately.
  • Implement rate limiting and concurrency throttling on sensitive stateful API endpoints.
  • Enforce CI/CD package dependency scanning using dotnet list package --vulnerable.

Remediation Steps:

  1. Identify all deployed ASP.NET Core runtime instances and Visual Studio development systems.
  2. Upgrade ASP.NET Core packages to fixed versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
  3. Update Visual Studio 2022 to 17.14.42 or higher, and Visual Studio 2026 to 18.10.4 or higher.
  4. Recompile and redeploy affected ASP.NET Core applications across staging and production environments.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment