Microsoft Fixes ASP.NET Core Security Feature Bypass CVE-2026-114156

Microsoft released a fix for CVE-2026-114156, an ASP.NET Core security feature bypass caused by improper input validation. The vulnerability allows an unauthenticated attacker to bypass a security feature over a network without user interaction, although exploitation requires high attack complexity. Microsoft rates it Important, with a CVSS v3.1 base score of 6.5, citing potential confidentiality and integrity impacts but no availability impact. At its November 10 disclosure, Microsoft reported no public disclosure or exploitation and assessed exploitation as less likely.

MITRE’s CWE-41: Improper Resolution of Path Equivalence describes a related input-handling weakness in which alternate representations of the same filesystem path can defeat access controls. Its guidance recommends allowlist validation, canonicalizing and decoding paths before authorization, and preventing double decoding; however, the supplied Microsoft advisory summary does not establish those specific exploit mechanics for this CVE. Organizations running ASP.NET Core should consult Microsoft’s Security Update Guide to identify affected deployments and apply the official fix, as the supplied details do not identify affected versions or update packages.