For a customer-facing ASP.NET app, verify which mailbox receives a password-reset message—and which component created that flow.
New November 10 disclosure
CVE-2026-118741 is improper authentication in ASP.NET Core. Microsoft says an unauthenticated attacker can request a reset using a distinct email address that the application treats as equivalent to the victim’s address, while mail reaches a different mailbox. Successful exploitation can take over the account without victim interaction. The address-equivalence and attacker-controlled-mailbox prerequisites explain the high attack complexity.
MSRC rates the issue Important, with CVSS 3.1 8.1. Microsoft reports no known exploitation or public disclosure and assesses exploitation as Less Likely. CISA KEV has no entry for this CVE. Suggested MSP priority is expedited for exposed applications with affected local identity flows.
What changed November 11
The November 11 MSRC data links Microsoft’s scaffolding advisory. It gives exact branch ranges, adds .NET 11 template coverage and documents how to repair applications generated from vulnerable templates. The original disclosure was November 10.
What changed November 11, 2026. The official November CVRF no longer lists Microsoft.DotNet.Web.ProjectTemplates.11.0 or its 11.0.0 download for this CVE. Microsoft’s scaffolding advisory still lists the two affected preview/RC template builds and 11.0.0 as the fix. The table retains that maintainer guidance. Check the actual template and generated reset handlers before closing affected .NET 11 deployments.
Affected components and fixes
| Component | Affected versions | Fixed version or action |
|---|---|---|
| MVC generator and Design packages, 8.x | 8.0.0–8.0.23, plus 8.0.0-preview.1.23117.2 | 8.0.24 |
| MVC generator and Design packages, 9.x | 9.0.0–9.0.12, plus 9.0.0-preview.1.24112.3 | 9.0.13 |
| MVC generator and Design packages, 10.x | 10.0.0–10.0.2, plus 10.0.0-rc.1.25458.5 | 10.0.3 |
| MVC generator and Design packages, 11.x | 11.0.0-preview.1.26156.3 and 11.0.0-preview.1.26230.3 | Repair generated handlers. Use fixed tooling for new scaffolding. |
| Web ProjectTemplates 8.x | 8.0.0–8.0.33, plus 8.0.0-rc.2.23480.2 | 8.0.34 |
| Web ProjectTemplates 9.x | 9.0.0–9.0.22, plus 9.0.0-preview.1.24081.5 | 9.0.23 |
| Web ProjectTemplates 10.x | 10.0.0–10.0.14, plus 10.0.0-preview.1.25120.3 | 10.0.15 |
| Web ProjectTemplates 11.x | 11.0.0-preview.1.26104.118 and 11.0.0-rc.3.26522.148 | 11.0.0 (maintainer advisory) |
| Microsoft.dotnet-scaffold | 10.0.0–10.0.2 and 20.0.0-preview.1.26156.3–20.1.0 | 20.3.0 |
| Microsoft.dotnet-scaffold-aspnet | 9.0.0–9.0.12, 9.0.0-preview.8.24467.5, 9.0.0-preview.9.24509.5, 10.0.0-rc.1.25458.5 and 10.0.0-rc.1.25468.1 | For new scaffolding, migrate to Microsoft.dotnet-scaffold 20.3.0. |
Microsoft.VisualStudio.Web.CodeGenerators.Mvc supplies the affected templates. Microsoft.VisualStudio.Web.CodeGeneration.Design can pull in that generator, so check the resolved MVC package before assigning exposure. The maintainer matrix above is more specific than the original CNA ranges. Listed prerelease builds are individually affected unless shown as a range. The fix for the scaffolding tool supports .NET 8 through 11. Project packages and SDK-bundled templates have their own fixes.
Keep the October Identity fix in scope
CVE-2026-70175 was published October 13 and concerns reset/confirmation mail sent to an unvalidated request address rather than the stored canonical address. Microsoft’s maintainer advisory lists ASP.NET runtime 8.0.0–8.0.31 → 8.0.32, 9.0.0–9.0.20 → 9.0.21 and 10.0.0–10.0.12 → 10.0.13 across Windows, Linux and macOS. Current MSRC data also maps standalone Microsoft.AspNetCore.Identity.UI to 2.3.14; its precise legacy affected range was not verified. This related issue is context for the November review, not a newly exploited October alert.
Inventory, update and test the deployed flow
Inventory project references, scaffold tools, templates, local identity providers and deployed reset/confirmation handlers. Ask the application owner to verify account normalization and the actual recipient chosen after lookup. If a susceptible flow is exposed, consider restricting or temporarily suspending that flow while the owner deploys a fix; this is a suggested containment measure, not a vendor workaround.
Update the affected scaffolding tools, project dependencies, separately installed templates and the SDK selected for the project. If a customer-facing reset flow is exposed, consider temporarily restricting the flow while the application owner prepares the repair.
For applications already generated from affected templates, Microsoft directs owners to correct both ForgotPassword and ResendEmailConfirmation, including Blazor equivalents. Keep the existing account lookup and token handling. Retrieve the stored email for the located account, reject missing addresses and use that stored address for delivery. Rebuild and redeploy the application, then verify reset and confirmation recipients with approved test accounts. Repeat the code repair if an affected template regenerates those handlers.
For the October Identity runtime update, restart the application. Rebuild and redeploy self-contained applications. Verify the resolved components and deployed application version.
No vendor-directed blanket credential rotation or mandatory compromise procedure was verified. Investigate suspicious reset activity and respond to confirmed account exposure through the customer’s incident-response process.
Official sources
CVE-2026-118741 · MSRC Nov data · Microsoft-authored CNA · Microsoft Identity advisory · CVE-2026-70175 · CISA KEV
November finding originally published November 10, 2026. Last verified November 11, 2026. Related Identity advisory originally published October 13.