{"metadata": {"vulnerability": "CVE-2026-70183", "count": 29, "kinds": {"milestone": 9, "sighting": 5, "kev": 0, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-03T23:48:30.860Z", "date_only": false, "value": "2026-08-03T23:48:30.860Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-70183", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70183", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70183", "record": "FKIE_CVE-2026-70183", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T11:56:15Z", "date_only": false, "value": "2026-10-13T11:56:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426", "record": "CVE-2026-70183", "field": "creation_timestamp", "uuid": "4bf8ba4e-d758-45aa-b125-5f38849e09b4", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426"}, {"timestamp": "2026-10-13T14:00:00Z", "date_only": false, "value": "2026-10-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70183", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T19:00:26.656Z", "date_only": false, "value": "2026-10-13T19:00:26.656Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-70183", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:19:32.417Z", "date_only": false, "value": "2026-10-13T19:19:32.417", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70183", "record": "FKIE_CVE-2026-70183", "field": "published"}, {"timestamp": "2026-10-13T19:59:23Z", "date_only": false, "value": "2026-10-13T19:59:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-494H-XX7X-5FRH", "record": "GHSA-494H-XX7X-5FRH", "field": "published"}, {"timestamp": "2026-10-13T19:59:24Z", "date_only": false, "value": "2026-10-13T19:59:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-494H-XX7X-5FRH", "record": "GHSA-494H-XX7X-5FRH", "field": "modified"}, {"timestamp": "2026-10-13T20:30:56Z", "date_only": false, "value": "2026-10-13T20:30:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/d53a578a0f8f19f39ff618766fb7fe70", "record": "CVE-2026-70183", "field": "creation_timestamp", "uuid": "72f9389d-4132-4ece-b692-608ecfd42c26", "content": "# CVE-2026-70183: CVE-2026-70183: Elevation of Privilege in ASP.NET Core and Visual Studio via Concurrent Race Condition\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70183\n\n## Summary\nAn elevation of privilege vulnerability exists in ASP.NET Core and Microsoft Visual Studio due to improper synchronization during concurrent thread execution. Authenticated remote attackers with low privileges can exploit a timing window to manipulate shared resources and assume higher-level execution contexts.\n\n## TL;DR\nA race condition in ASP.NET Core allows authenticated low-privilege remote users to elevate privileges by sending high-frequency concurrent requests that hit unsynchronized shared memory structures.\n\n## Technical Details\n\n- **CWE ID**: CWE-362 (Race Condition)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Privileges Required**: Low (PR:L)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **CISA KEV Status**: Not Listed\n- **Exploit Status**: Unproven / No Public PoC\n- **Impact**: Elevation of Privilege (High C/I/A)\n\n## Affected Systems\n\n- ASP.NET Core 8.0 (< 8.0.32)\n- ASP.NET Core 9.0 (< 9.0.21)\n- ASP.NET Core 10.0 (< 10.0.13)\n- ASP.NET Core 11.0 (< 11.0.0-rc.2)\n- Microsoft Visual Studio 2022 v17.14 (< 17.14.42)\n- Microsoft Visual Studio 2026 v18.10 (< 18.10.4)\n- **ASP.NET Core 8.0**: < 8.0.32 (Fixed in: `8.0.32`)\n- **ASP.NET Core 9.0**: < 9.0.21 (Fixed in: `9.0.21`)\n- **ASP.NET Core 10.0**: < 10.0.13 (Fixed in: `10.0.13`)\n- **ASP.NET Core 11.0**: < 11.0.0-rc.2 (Fixed in: `11.0.0-rc.2`)\n- **Microsoft Visual Studio 2022 (v17.14)**: 17.14.0 - < 17.14.42 (Fixed in: `17.14.42`)\n- **Microsoft Visual Studio 2026 (v18.10)**: 18.10.0 - < 18.10.4 (Fixed in: `18.10.4`)\n\n## Mitigation\n\n- Apply vendor security patches for ASP.NET Core and Microsoft Visual Studio immediately.\n- Implement rate limiting and concurrency throttling on sensitive stateful API endpoints.\n- Enforce CI/CD package dependency scanning using dotnet list package --vulnerable.\n\n**Remediation Steps:**\n1. Identify all deployed ASP.NET Core runtime instances and Visual Studio development systems.\n2. Upgrade ASP.NET Core packages to fixed versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.\n3. Update Visual Studio 2022 to 17.14.42 or higher, and Visual Studio 2026 to 18.10.4 or higher.\n4. Recompile and redeploy affected ASP.NET Core applications across staging and production environments.\n\n## References\n\n- [Microsoft Security Advisory / Update Guide: CVE-2026-70183](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70183)\n- [CVE Record Entry: CVE-2026-70183](https://www.cve.org/CVERecord?id=CVE-2026-70183)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70183) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/d53a578a0f8f19f39ff618766fb7fe70"}, {"timestamp": "2026-10-13T21:00:00Z", "date_only": false, "value": "2026-10-13T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2106", "record": "CVE-2026-70183", "field": "creation_timestamp", "uuid": "452ac2fb-5d2d-49e5-8de2-d5cdf6c871f9", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2106"}, {"timestamp": "2026-10-13T23:57:53.392Z", "date_only": false, "value": "2026-10-13T23:57:53.392100Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117436309359495705", "record": "CVE-2026-70183", "field": "creation_timestamp", "uuid": "6ade4f90-5a80-4331-8295-b05c418c6b07", "content": "CVE-2026-70183 ASP.NET Core Elevation of Privilege Vulnerability Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-70183https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70183#Microsoft #ASP.NETCore10.0 #ASP.NETCore11.0 #ASP.NETCore8.0 #ASP.NETCore9.0 #MicrosoftVisualStudio2022version17.14 #MicrosoftVisualStudio2026version18.10#CVE_2026_70183#bot", "url": "https://infosec.exchange/users/cve/statuses/117436309359495705"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T01:49:33Z", "date_only": false, "value": "2026-10-14T01:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "record": "CVE-2026-70183", "field": "creation_timestamp", "uuid": "9cddd845-22ca-4f56-8cfd-f5421bf2d7c9", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25"}, {"timestamp": "2026-10-14T03:57:17.174Z", "date_only": false, "value": "2026-10-14T03:57:17.174Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70183", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T04:18:32.850Z", "date_only": false, "value": "2026-10-14T04:18:32.850", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70183", "record": "FKIE_CVE-2026-70183", "field": "lastModified"}, {"timestamp": "2026-10-16T23:20:02.991Z", "date_only": false, "value": "2026-10-16T23:20:02.991Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-70183", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T23:20:02.991Z", "date_only": false, "value": "2026-10-16T23:20:02.991Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70183", "field": "containers.cna.providerMetadata.dateUpdated"}]}