CVE-2026-70188
Microsoft — ASP.NET Core Security Feature Bypass Vulnerability
Patch Tuesday
What EVULNABLE says
An EPSS probability of 0.008, and CVSS base score 9.1.
Scheduled Maintenance
The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.
The evidence behind it
| Measure | Value | Source | What it means |
|---|---|---|---|
| CVSS base score | 9.1 | — | How severe the flaw is in itself. It does not say how likely an attack is. |
| FIRST EPSS | 0.008 (56.7th pctl) | FIRST | FIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. |
| Actively exploited | Not confirmed | Patch Tuesday | Whether a source of record has confirmed attacks using it in the wild. |
| Fixed in | Microsoft.AspNetCore.App.Runtime.linux-arm: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-arm64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-musl-arm: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-x64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.osx-arm64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.osx-x64: 11.0.0-rc.2 | NVD | The version(s) the vendor has published as fixed, where NVD records one. |
| Public exploit module | None known | Metasploit | Module existing is not the same as active exploitation. |
| EUVD cross-reference | Listed | ENISA EUVD | ENISA's own vulnerability database entry for this CVE, where one exists. |
Impacted software or hardware: Not identified by the connected sources
Fixed versions: Microsoft.AspNetCore.App.Runtime.linux-arm: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-arm64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-musl-arm: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-musl-x64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.linux-x64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.osx-arm64: 11.0.0-rc.2 | Microsoft.AspNetCore.App.Runtime.osx-x64: 11.0.0-rc.2
Remediation: Apply the vendor patch or guidance: https://github.com/advisories/GHSA-fpq8-4vhr-rcxx | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70188
Remediation basis: External remediation intelligence
ENISA EUVD also lists this CVE at CVSS 9.1 (v3.1), assigned by microsoft. Source: euvd.enisa.europa.eu.
GitHub Advisory Database, GHSA-fpq8-4vhr-rcxx, lists affected packages:
Microsoft.AspNetCore.App.Runtime.linux-arm(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.linux-arm64(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.linux-musl-arm(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.linux-musl-x64(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.linux-x64(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.osx-arm64(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2Microsoft.AspNetCore.App.Runtime.osx-x64(nuget) affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2- and 36 more — see GHSA-fpq8-4vhr-rcxx on GitHub for the full list
Advisory data from GitHub, CC-BY-4.0.
2 days recorded, 2026-10-14 to 2026-10-15
0.83% as of 2026-10-15 (56.6th percentile). FIRST EPSS, recorded daily since this page started tracking it.
2026-10-14
2026-10-15
The primary records
This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.
Where this sits
CVE-2026-70188 is one of the entries ranked on the priority feed and in this month's Microsoft release.