CVE-2026-114155 is a high-severity (CVSS 7.5) CWE-367 vulnerability in Microsoft.DotNet.HotReload.Watch.Aspire. A fix is available for Microsoft.DotNet.HotReload.Watch.Aspire — see the affected versions and patch details below.
Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
Microsoft.DotNet.HotReload.Watch.Aspire.NETMicrosoft.DotNet.HotReload.Watch.Aspire.NETMicrosoft.DotNet.HotReload.Watch.AspireReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.
A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502
CVSS Details
- Version: 3.1
- Severity: High
- Score: 7.5 (base score)
- Vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-367
- MSRC severity: Important
- Impact: Elevation of Privilege
Affected Platforms
- Platforms: Linux, macOS.
- Architectures: Linux: Arm, Arm64, x64; macOS: Arm64, x64
Windows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.
<a name="affected-packages"></a>Affected Packages
The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.
Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.
.NET SDK 10.0.3xx
| Package | Affected version | Patched version |
|---|---|---|
| .NET SDK (dotnet-watch) 10.0.3xx | >= 10.0.300, <= 10.0.303 | 10.0.404 |
.NET SDK 10.0.4xx
| Package | Affected version | Patched version |
|---|---|---|
| .NET SDK (dotnet-watch) 10.0.4xx | >= 10.0.400, <= 10.0.403 | 10.0.404 |
.NET SDK 11.0.1xx
| Package | Affected version | Patched version |
|---|---|---|
| .NET SDK (dotnet-watch) 11.0.1xx | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100 |
Separately restored Aspire watch tool
| Package | Affected version | Patched version |
|---|---|---|
| Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.300, <= 10.0.303 | 10.0.404 |
| Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.400, <= 10.0.403 | 10.0.404 |
| Microsoft.DotNet.HotReload.Watch.Aspire | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100 |
This tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
Run dotnet --version from the directory where you run dotnet-watch to identify the selected SDK. Use dotnet --info and dotnet --list-sdks to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable global.json, including its version and rollForward settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See .NET SDK selection.
Review use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.
<a name="how-fix"></a>How do I fix the issue?
The fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs installed through Visual Studio, update Visual Studio to a release that includes a fixed SDK. Updating only an application runtime does not replace SDK-bundled tools.
Ensure that global.json and its SDK roll-forward policy select a fixed SDK, then rerun dotnet --version in the working directory to verify the selection. The SDK-bundled watch tool is installed beneath that selected SDK's DotnetTools/dotnet-watch directory.
If Microsoft.DotNet.HotReload.Watch.Aspire is restored separately, update its package reference or the consuming tool's version configuration to 10.0.404 or 11.0.100, as applicable, restore the tool, and restart the consuming process. An SDK update alone does not update that restored copy.
Other Information
Reporting Security Issues
If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
External Links
Acknowledgements
Revisions
V1.0 (November 10, 2026): Advisory published.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| .NETNuGet | Microsoft.DotNet.HotReload.Watch.Aspire | ≥ 10.0.300&&< 10.0.404 | 10.0.404dotnet add package Microsoft.DotNet.HotReload.Watch.Aspire --version 10.0.404 |
| .NETNuGet | Microsoft.DotNet.HotReload.Watch.Aspire | ≥ 10.0.400&&< 10.0.404 | 10.0.404dotnet add package Microsoft.DotNet.HotReload.Watch.Aspire --version 10.0.404 |
| .NETNuGet | Microsoft.DotNet.HotReload.Watch.Aspire | ≥ 11.0.100-preview.3.26207.106&&< 11.0.100 | 11.0.100dotnet add package Microsoft.DotNet.HotReload.Watch.Aspire --version 11.0.100 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.DotNet.HotReload.Watch.Aspire, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Microsoft.DotNet.HotReload.Watch.Aspire to 10.0.404 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-114155 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-114155 in your dependencies?
Find it across NuGet, including transitive dependencies.