CVE-2026-114156: Path Equivalence Security Feature Bypass in Microsoft ASP.NET Core

Vulnerability ID: CVE-2026-114156
CVSS Score: 6.5
Published: 2026-11-11

CVE-2026-114156 is an improper resolution of path equivalence vulnerability (CWE-41) in Microsoft ASP.NET Core affecting .NET 11.0 preview releases and Microsoft Visual Studio 2026. The vulnerability stems from a discrepancy between how path prefix validation helpers (such as PathString.StartsWithSegments) and downstream routing mechanisms handle alternate path separators and percent-encoded characters. An unauthenticated remote attacker can exploit this mismatch over the network to bypass path-based authorization middleware and access restricted endpoints.

TL;DR

An improper path equivalence resolution flaw in ASP.NET Core (.NET 11.0 preview builds) allows unauthenticated remote attackers to bypass path-based security controls using alternate or encoded path delimiters. Updating to .NET 11.0.0 GA or Visual Studio 2026 version 18.12.0 resolves the issue.

Technical Details

• Vulnerability ID: CVE-2026-114156
• Weakness Class: CWE-41 (Improper Resolution of Path Equivalence)
• CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)
• Attack Vector: Network (Unauthenticated HTTP Request)
• Primary Impact: Security Feature Bypass (High Integrity, Low Confidentiality)
• Affected Component: ASP.NET Core Path Processing (PathString.StartsWithSegments)
• Exploit Status: Unproven (No Public PoCs)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft .NET 11.0 (Linux, macOS, Windows)
• Microsoft ASP.NET Core 11.0
• Microsoft Visual Studio 2026
• .NET 11.0 (Linux, macOS, Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
• Microsoft Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

• Upgrade .NET 11.0 preview installations to the official .NET 11.0.0 GA release.
• Migrate from custom path-prefix authorization middleware to ASP.NET Core Endpoint Routing authorization policies.
• Configure reverse proxies and WAFs to block or normalize requests containing literal or percent-encoded backslashes (%5C) in the URI path.

Remediation Steps:

1. Identify all hosts and container images running .NET 11.0 preview builds (>= 11.0.0-preview.1, < 11.0.0) or Visual Studio 2026 (< 18.12.0).
2. Download and install the .NET 11.0.0 SDK and ASP.NET Core Runtime from official Microsoft package repositories.
3. Update Microsoft Visual Studio 2026 installations to version 18.12.0 or newer.
4. Audit application middleware pipelines for security checks relying on PathString.StartsWithSegments and refactor them to use endpoint-based RequireAuthorization().
5. Restart all affected Kestrel, IIS, and containerized ASP.NET Core worker processes to ensure the updated runtime assemblies are loaded.

References

• Microsoft Security Update Guide Advisory: CVE-2026-114156
• CVE.org Official Record: CVE-2026-114156
• Official ASP.NET Core v11.0.0 Release
• CWE-41: Improper Resolution of Path Equivalence
• Shodan CVEDB Entry: CVE-2026-114156
• MITRE ATT&CK T1211: Exploitation for Defense Evasion
• MITRE ATT&CK T1190: Exploit Public-Facing Application

Read the full report for CVE-2026-114156 on our website for more details including interactive diagrams and full exploit analysis.