{"id":"CVE-2026-118740","published":"2026-11-10T19:19:50.740","lastModified":"2026-11-10T20:18:25.297","description":"Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118740","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Missing authorization in Aspire allows unauthenticated remote attackers to bypass a security control over the network, potentially gaining unauthorized access to protected resources or functionality. This flaw is rated critical (CVSS 9.1) due to high confidentiality and integrity impact with no authentication required.","exploitability":"Exploitation requires only network access to the vulnerable endpoint; no authentication or user interaction is needed, making it trivial for remote attackers.","blast_radius":"Successful exploitation could allow an attacker to read or modify sensitive data, escalate privileges, or compromise system integrity without detection, depending on the specific security feature bypassed.","remediation":"No fixed version or patch level is specified in the published description; apply vendor-recommended workarounds immediately—restrict access to the affected endpoint via network segmentation or firewall rules—and monitor for unauthorized access attempts until a patch is released.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","network-exploitable","critical-severity","missing-authorization"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:58:26.454Z"}}