JEDI-SEC | Security Research & Digital Defense

GHSA-7phj-vgxq-r67h: Microsoft Security Advisory CVE-2026-114157 – ASP.NET Core Security Feature Bypass Vulnerability

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-114157
  • Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget
  • Packages: Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core’s Kestrel Named Pipes transport. This advisory provides guidance on updating affected applications and components.

A Kestrel named-pipe listener configured with `CurrentUserOnly` can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/507

## CVSS Details

– **Version:** 3.1
– **Severity:** High
– **Score:** 7.5 (base score)
– **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C`
– **Weakness:** CWE-362
– **MSRC severity:** Important
– **Impact:** Security Feature Bypass

## Affected Platforms

– **Platforms:** Windows
– **Architectures:** Arm64, x64, x86

## Affected Packages

Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes ships in the ASP.NET Core shared framework and runtime packs; it is not a separately packable NuGet package.

Affected intervals and patched release versions are listed below.

### .NET 8.0 – affected runtime packages

Package | Affected version | Patched version
— | — | —
[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, = 8.0.0-preview.1.23112.2, = 8.0.0-preview.1.23112.2, = 9.0.0-preview.1.24081.5, = 9.0.0-preview.1.24081.5, = 9.0.0-pr…

Source: GitHub Security Advisories · 2026-11-11

More posts