在ASP.NET Core Web API中，要覆盖已存在的CORS Middleware，可通过以下代码实现：

1. 创建一个覆盖CORS Middleware的自定义Middleware：

public class CustomCORSMiddleware
{
    private readonly RequestDelegate _next;
    private readonly CorsPolicy _policy;

    public CustomCORSMiddleware(RequestDelegate next, CorsPolicy policy)
    {
        _next = next;
        _policy = policy;
    }

    public async Task Invoke(HttpContext context)
    {
        var corsService = context.RequestServices.GetService(typeof(ICorsService)) as ICorsService;
        var corsPolicyProvider = context.RequestServices.GetService(typeof(ICorsPolicyProvider)) as ICorsPolicyProvider;
        var corsResult = await corsService.EvaluatePolicyAsync(context, _policy);
        if (corsResult.IsPreflight)
        {
            var policy = await corsPolicyProvider.GetCorsPolicyAsync(context, corsResult).ConfigureAwait(false);
            context.Response.Headers.AddRange(policy.ToCorsHeaders());
            context.Response.StatusCode = (int)HttpStatusCode.NoContent;
        }
        else
        {
            context.Response.Headers.AddRange(corsResult.ToCorsHeaders());
            await _next(context);
        }
    }
}

2. 使用自定义Middleware覆盖默认的CORS Middleware：

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    //覆盖默认的CORS Middleware
    app.UseMiddleware(new CorsPolicy
    {
        AllowAnyHeader = true,
        AllowAnyMethod = true,
        AllowAnyOrigin = true
    });

    //其他Middleware...
}

以上代码中，使用了自定义的CORS Middleware覆盖了默认的CORS Middleware，并允许来自任何来源、任何方法和任何标头的请求。通过更改CorsPolicy的属性可以定义更严格的策略。