CVE-2026-112044 dotnet CVE debrief

Who should care

Defenders responsible for dotnet eShop deployments should assess exposure and verify the affected component. The vulnerability has a medium severity score and can be exploited remotely.

Why it matters

CVE-2026-112044 is a medium-severity vulnerability in dotnet eShop that can be exploited remotely, allowing for improper authentication. Defenders should prioritize verifying the affected component and assessing exposure.

• Verify authentication mechanisms for Catalog API
• Assess exposure of affected deployments
• Monitor for potential exploitation attempts

Technical summary

The vulnerability is located in the AddApplicationServices function of the Catalog API in dotnet eShop, up to version 913acea66708a59595351174cee9b29f37179d29. The issue is related to improper authentication, allowing for remote exploitation. This function is part of the Catalog API, which is a critical component of dotnet eShop. The vulnerability's improper authentication mechanism could allow attackers to bypass normal authentication processes, potentially leading to unauthorized access or other security breaches.

Defensive priority

Defenders should prioritize verifying the affected component and assessing exposure, as the vulnerability can be exploited remotely and has a medium severity score.

Recommended defensive actions

• Verify the affected component and assess exposure
• Review the AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but the vendor has not yet responded to the issue report. The affected version is up to 913acea66708a59595351174cee9b29f37179d29.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.