CVE-2026-109481

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1094856.3Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.CVE-2026-1094877.5Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.CVE-2026-109498.3Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to CVE-2026-1094917.5Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1094928.8Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a networkCVE-2026-1094938.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1094948.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1094956.6Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1094968.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1094977.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-1094987.5Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1094998.8Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code o
CVE-2026-109481: High severity, CVSS 7.5 | Vulnix