Skip to main content
Apexward Pulse
Type Vulnerability

Microsoft

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally

1 sourceCVE-2026-114157

At a glance

Low
30-day window, from the last update
None observed
Evidence-weighted, not popularity
Why Low

Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.

Briefing

  • IT leaders should verify if ASP.NET Core is in their estate and review security update information.

Questions to ask IT

  • Do we run Microsoft Asp.net Core, and which versions?
  • If it is not yet patched, what mitigation is in place, and will the fix be done by 11 Dec?

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • A race condition in ASP.NET Core could allow an authorised attacker to escalate privileges on a local system.
  • Security updates links and information have been modified.

Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)

Products and services involved

Pulse

Last change 42m ago · Next recheck 12 Nov 2026, 18:03 UK time

  1. Story11 Nov 2026, 18:03 UK time · 42m ago

    Linked reporting from Microsoft Security Update Guide RSS (vendor psirt).

    Read source (Microsoft Security Update Guide RSS)

1 entry so far. The timeline chart appears once this story has more history.

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorised attacker to elevate privileges locally

  • ProbableSummary fact75% confidence

    Changes made to the security updates links and information.

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-114157