RHSA-2026:92511HighCVSS 7.8

Red Hat Security Advisory: .NET 11.0 security, bug fix, and enhancement update

Published
October 29, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (2)

CVE-2026-62909 →CVE-2026-114148 →

📋 Description

CVE-2026-62909 — .NET: .NET Elevation of Privilege Vulnerability CVE-2026-114148 — dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

🎯 Affected products121

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • aspnetcore-runtime-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-dbg-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-dbg-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-dbg-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-runtime-dbg-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-targeting-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-targeting-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-targeting-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aspnetcore-targeting-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-0:11.0.100~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-0:11.0.100~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-0:11.0.100~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-0:11.0.100~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-0:11.0.0~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • dotnet-apphost-pack-11.0-debuginfo-0:11.0.0~rc.3.26522.148-0.12.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • +91 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to correct file ownership and set restrictive write permissions across all extracted Linux .NET runtime and targeting pack directories: upgrade to ASP.NET Core Runtime 8.0.33, 9.0.22; .NET SDK 8.0.133, 9.0.123 (or the fixed Dotnet builds), which sets correct file ownership and permissions on Linux .NET tarball distributions to prevent unprivileged modification of runtime files, closing all 2 injection vectors (modification of runtime files with insecure ownership, binary or shared library replacement leading to privileged code execution). Until patched, this is only a concern on Linux systems hosting .NET runtimes or targeting packs installed from affected Linux tarballs with local user access — Standalone NuGet packages and other Microsoft-published non-ASP.NET .NET runtime and SDK tarballs are unaffected — so Restrict local shell access and audit or eliminate write permissions for non-root users across .NET runtime directories on multi-user hosts. As a compensating measure, Audit file write and modification syscalls directed at improperly owned .NET runtime directories and binaries with auditd, Enforce SELinux to restrict unprivileged processes from writing to system files or executing unauthorized code, Apply SELinux confined user mappings to restrict local users from modifying sensitive system files, Deploy EDR agents to detect and quarantine unauthorized runtime library modifications and privilege escalation attempts, Monitor writes to runtime directories and execution of unexpected child shells using Falco or eBPF runtime security, and Deploy AIDE file integrity monitoring to alert on unauthorized modifications or replacements of installed .NET binaries and libraries. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure file ownership defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)

🔗 References (8)