If you run Microsoft Aspire, check where its Dashboard is reachable and which version is actually deployed. Microsoft’s November update fixes an authentication bypass and addresses separate risks in AppHost and the CLI.
New Microsoft guidance · November 10–11, 2026
Microsoft published the CVEs on November 10. The November 11 MSRC snapshot lists separate Dashboard and SDK rows, and Microsoft’s maintainers published exact CLI package ranges November 11 UTC. MSRC rates all four Important and reports no known exploitation or public disclosure, with exploitation assessed Less Likely. CISA KEV did not list these CVEs when checked November 11.
| CVE and CVSS 3.1 | Applicability | Update |
|---|---|---|
| CVE-2026-118740 · 9.1 Critical CVSS | Aspire Dashboard and Aspire.Dashboard.Sdk.linux-x64 13.6.1–13.6.4. An unauthenticated user with network access can impersonate a user and access or alter telemetry. MSRC also lists the Dashboard on Linux and Windows, with the generic Aspire.Dashboard.Sdk package as the update for those rows. | Deploy Dashboard or the applicable SDK 13.6.5 or later. |
| CVE-2026-120006 · 7.5 High CVSS | Aspire.Hosting and Aspire.Hosting.AppHost below 13.6.5. Microsoft’s maintainer advisory identifies macOS x64 and Arm64, where a signed-in developer follows a resource link through an HTTPS YARP gateway to an untrusted container. | Update the AppHost SDK or explicit package pins and verify both hosting dependencies resolve to 13.6.5 or later. |
| CVE-2026-120778 and CVE-2026-120792 · 7.3 High CVSS each | Linux and macOS x64 and Arm64 where users share temporary directories. CLI-generated builds can expose developer privileges. CLI agent or MCP initialization can expose configuration in diagnostic files. | Update Aspire.Cli 13.2.0–13.6.4, platform NuGet packages 13.3.0–13.6.4 and the applicable npm packages 13.4.2–13.6.4 to 13.6.5 or later. See the maintainer tables for package names. |
Suggested MSP action
Prioritize reachable Dashboards. Inventory each customer’s Dashboard deployments and ingress, AppHost package locks and shared Linux or macOS build hosts. Restrict Dashboard access to trusted networks while patching. Restore dependencies, rebuild and redeploy affected workloads, and restart AppHosts. Verify the deployed version, resolved packages and expected authentication behavior. If untrusted access or shared diagnostic files exposed credentials, investigate access and rotate the affected credentials. Microsoft’s advisories prescribe component updates. A .NET runtime update alone does not update Aspire.
Last verified November 11, 2026.
Official sources
MSRC CVE-2026-118740 · November MSRC CVRF · Aspire 13.6.5 · Microsoft AppHost advisory · Microsoft CLI privilege advisory · Microsoft CLI disclosure advisory · CISA KEV data