CVE-2026-70183 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-70183

CVE-2026-70183

Published:October 13, 2026

Updated:October 14, 2026

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Affected Packages

microsoft.aspnetcore.app.runtime.win-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-arm (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

Related Resources (6)

https://github.com/dotnet/aspnetcore/discussions/69796

https://github.com/dotnet/aspnetcore/security/advisories/GHSA-494h-xx7x-5frh

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70183

https://nvd.nist.gov/vuln/detail/CVE-2026-70183

https://github.com/dotnet/announcements/issues/460

https://github.com/dotnet/aspnetcore

Do you need more information?

CVSS v4

Base Score:

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Exploit Maturity

UNPROVEN

Weakness Type (CWE)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-362

AI app security

Mend AI

Application security

Mend AppSec

Dependency management

Mend Renovate

Expand coverage

Runtime and beyond

AI security

Code security

Supply chain security

Compliance & reporting

vs. AI security tools

vs. AppSec tools

Buyer’s guides

About Mend.io

Partners & people

Customers

Learn & explore

Guides

Developers hub