ASP.NET Core Elevation of Privilege Vulnerability
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely CVE-2026-118741 · score 8.1/10
What could go wrong?
Someone who already has a normal account could give themselves full admin rights.
How urgent is it?
Check Microsoft’s page for details.
Who is affected?
Microsoft.VisualStudio.Web.CodeGenerators.Mvc, Microsoft.VisualStudio.Web.CodeGeneration.Design, Microsoft.dotnet-scaffold-aspnet, Microsoft.dotnet-scaffold, Microsoft.VisualStudio.Web.CodeGeneration.Design on .NET 8.0, Microsoft.VisualStudio.Web.CodeGeneration.Design on .NET 9.0, Microsoft.DotNet.Web.ProjectTemplates.8.0, Microsoft.DotNet.Web.ProjectTemplates.9.0 and 8 more versions
What should I do?
Install this month’s updates via Windows Update, Intune or your update tool, then restart.
Known problems
Microsoft lists known issues per update: no KB article listed. Official page.