DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-70183: CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition

#security #cve #cybersecurity

CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition

Vulnerability ID: CVE-2026-70183
CVSS Score: 7.5
Published: 2026-10-13

An elevation of privilege vulnerability exists in ASP.NET Core and Microsoft Visual Studio due to improper synchronization during concurrent thread execution. Authenticated remote attackers with low privileges can exploit a timing window to manipulate shared resources and assume higher-level execution contexts.

TL;DR

A race condition in ASP.NET Core allows authenticated low-privilege remote users to elevate privileges by sending high-frequency concurrent requests that hit unsynchronized shared memory structures.

Technical Details

  • CWE ID: CWE-362 (Race Condition)
  • Attack Vector: Network (AV:N)
  • Attack Complexity: High (AC:H)
  • Privileges Required: Low (PR:L)
  • CVSS v3.1 Score: 7.5 (High)
  • CISA KEV Status: Not Listed
  • Exploit Status: Unproven / No Public PoC
  • Impact: Elevation of Privilege (High C/I/A)

Affected Systems

  • ASP.NET Core 8.0 (< 8.0.32)
  • ASP.NET Core 9.0 (< 9.0.21)
  • ASP.NET Core 10.0 (< 10.0.13)
  • ASP.NET Core 11.0 (< 11.0.0-rc.2)
  • Microsoft Visual Studio 2022 v17.14 (< 17.14.42)
  • Microsoft Visual Studio 2026 v18.10 (< 18.10.4)
  • ASP.NET Core 8.0: < 8.0.32 (Fixed in: 8.0.32)
  • ASP.NET Core 9.0: < 9.0.21 (Fixed in: 9.0.21)
  • ASP.NET Core 10.0: < 10.0.13 (Fixed in: 10.0.13)
  • ASP.NET Core 11.0: < 11.0.0-rc.2 (Fixed in: 11.0.0-rc.2)
  • Microsoft Visual Studio 2022 (v17.14): 17.14.0 - < 17.14.42 (Fixed in: 17.14.42)
  • Microsoft Visual Studio 2026 (v18.10): 18.10.0 - < 18.10.4 (Fixed in: 18.10.4)

Mitigation Strategies

  • Apply vendor security patches for ASP.NET Core and Microsoft Visual Studio immediately.
  • Implement rate limiting and concurrency throttling on sensitive stateful API endpoints.
  • Enforce CI/CD package dependency scanning using dotnet list package --vulnerable.

Remediation Steps:

  1. Identify all deployed ASP.NET Core runtime instances and Visual Studio development systems.
  2. Upgrade ASP.NET Core packages to fixed versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
  3. Update Visual Studio 2022 to 17.14.42 or higher, and Visual Studio 2026 to 18.10.4 or higher.
  4. Recompile and redeploy affected ASP.NET Core applications across staging and production environments.

References

Read the full report for CVE-2026-70183 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)