CVE-2026-109476 ASP.NET Core Information Disclosure Vulnerability

EPSS

0.6% estimated probability of exploitation activity in the next 30 days; 51st percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.

CISA's assessment (SSVC)

Exploitation: none · Automatable: no · Technical impact: partial, assessed 2026-11-10. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.

CWE

CWE-116 Improper Encoding or Escaping of Output

OWASP Top 10

A05:2025 Injection

Published

2026-11-10 19:18 UTC

Modified

2026-11-10 22:18 UTC

Assigned by

microsoft (CNA)

NVD analysis

Awaiting analysis

Record from

the NVD, synced 2026-11-10 22:42 UTC

[![CVE-2026-109476](https://cve.bz/cve/badge/CVE-2026-109476.svg)](https://cve.bz/cve/CVE-2026-109476)

<a href="https://cve.bz/cve/CVE-2026-109476"><img src="https://cve.bz/cve/badge/CVE-2026-109476.svg" alt="CVE-2026-109476"></a>

Affected

• microsoft:.net 10.0 installed on linux
• microsoft:.net 10.0 installed on mac os
• microsoft:.net 10.0 installed on windows
• microsoft:.net 11.0 installed on linux
• microsoft:.net 11.0 installed on mac os
• microsoft:.net 11.0 installed on windows
• microsoft:.net 8.0 installed on linux
• microsoft:.net 8.0 installed on mac os
• microsoft:.net 8.0 installed on windows
• microsoft:.net 9.0 installed on linux
• microsoft:.net 9.0 installed on mac os
• microsoft:.net 9.0 installed on windows
• microsoft:microsoft visual studio 2022 version 17.14
• microsoft:microsoft visual studio 2026 version 18.11
• microsoft:microsoft visual studio 2026 version 18.12

Versions

From the CNA's record in the CVE List.

Fix and patched versions

• Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0
• Ubuntu, Red Hat, AlmaLinux, Rocky Linux, Alpine: fixed package versions per release

Packages (OSV)

Linux distributions

From the distributions' data via OSV.dev: Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Red Hat Security Data © Red Hat, Inc., CC BY 4.0; AlmaLinux's OSV database, MIT; Rocky Linux's errata, BSD-3-Clause; the Alpine secdb, CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Ubuntu · Red Hat · Alpine.

Red Hat

Red Hat rates this Important.

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-109476.

Attack patterns (CAPEC)

• CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
• CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
• CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
• CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109476

Check your stackJSON