Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by microsoft

CVE-2026-102870ASP.NET Core Remote Code Execution Vulnerability

High 8.8

In plain English

A high-severity code injection in Microsoft.AspNetCore.Components.WebAssembly.DevServer from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 40.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10aspnetcore-runtime-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8aspnetcore-runtime-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9aspnetcore-runtime-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10aspnetcore-runtime-dbg-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8aspnetcore-runtime-dbg-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9aspnetcore-runtime-dbg-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10aspnetcore-targeting-pack-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8aspnetcore-targeting-pack-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9aspnetcore-targeting-pack-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:8dotnet10.0.113-1.el8_10ALSA-2026:86192
AlmaLinux:10dotnet-apphost-pack-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-apphost-pack-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-apphost-pack-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-host10.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:9dotnet-host10.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-hostfxr-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-hostfxr-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-hostfxr-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-runtime-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-runtime-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-runtime-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-runtime-dbg-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-runtime-dbg-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-runtime-dbg-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-sdk-10.010.0.113-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-sdk-10.010.0.113-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-sdk-10.010.0.113-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-sdk-10.0-source-built-artifacts10.0.113-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-sdk-10.0-source-built-artifacts10.0.113-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-sdk-10.0-source-built-artifacts10.0.113-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-sdk-aot-10.010.0.113-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-sdk-aot-10.010.0.113-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-sdk-aot-10.010.0.113-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-sdk-dbg-10.010.0.113-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-sdk-dbg-10.010.0.113-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-sdk-dbg-10.010.0.113-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-targeting-pack-10.010.0.13-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-targeting-pack-10.010.0.13-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-targeting-pack-10.010.0.13-1.el9_8ALSA-2026:86193
AlmaLinux:10dotnet-templates-10.010.0.113-1.el10_2ALSA-2026:86195
AlmaLinux:8dotnet-templates-10.010.0.113-1.el8_10ALSA-2026:86192
AlmaLinux:9dotnet-templates-10.010.0.113-1.el9_8ALSA-2026:86193
Alpine:v3.23dotnet10-runtime10.0.13-r0ALPINE-CVE-2026-102870
Alpine:v3.24dotnet10-runtime10.0.13-r0ALPINE-CVE-2026-102870
NuGetmicrosoft.aspnetcore.components.webassembly.server10.0.14GHSA-g27p-qf6j-c96c
NuGetmicrosoft.aspnetcore.components.webassembly.server11.0.0-rc.3.26522.148GHSA-g27p-qf6j-c96c
Rocky Linux:10dotnet10.00:10.0.113-1.el10_2RLSA-2026:86195
Rocky Linux:8dotnet10.00:10.0.113-1.el8_10RLSA-2026:86192
Rocky Linux:9dotnet10.00:10.0.113-1.el9_8RLSA-2026:86193
Ubuntu:24.04:LTSdotnet1010.0.114-10.0.14-0ubuntu1~24.04.1UBUNTU-CVE-2026-102870
Ubuntu:24.04:LTSdotnet1010.0.113-10.0.13-0ubuntu1~24.04.1USN-8942-1
Ubuntu:24.04:LTSdotnet1010.0.114-10.0.14-0ubuntu1~24.04.1USN-8958-1
Ubuntu:26.04:LTSdotnet1010.0.114-10.0.14-0ubuntu1~26.04.1UBUNTU-CVE-2026-102870
Ubuntu:26.04:LTSdotnet1010.0.113-10.0.13-0ubuntu1~26.04.1USN-8942-1
Ubuntu:26.04:LTSdotnet1010.0.114-10.0.14-0ubuntu1~26.04.1USN-8958-1
Ubuntu:26.10dotnet1010.0.114-10.0.14-0ubuntu1~26.10.1USN-8958-1
Ubuntu:26.10dotnet1010.0.113-10.0.13-0ubuntu1~26.10.1USN-8942-1
Ubuntu:26.10dotnet1010.0.114-10.0.14-0ubuntu1~26.10.1UBUNTU-CVE-2026-102870
Ubuntu:26.10dotnet1111.0.100-11.0.0~rc3-0ubuntu1~26.10.1UBUNTU-CVE-2026-102870
Ubuntu:26.10dotnet1111.0.100-11.0.0~rc2-0ubuntu1~26.10.1USN-8942-1
Ubuntu:26.10dotnet1111.0.100-11.0.0~rc3-0ubuntu1~26.10.1USN-8958-1
Ubuntu:22.04:LTSdotnet7no fix listedUBUNTU-CVE-2026-102870
Ubuntu:22.04:LTSdotnet88.0.132-8.0.32-0ubuntu1~22.04.1USN-8942-1
Ubuntu:22.04:LTSdotnet88.0.133-8.0.33-0ubuntu1~22.04.1USN-8958-1
Ubuntu:24.04:LTSdotnet88.0.133-8.0.33-0ubuntu1~24.04.1USN-8958-1
Ubuntu:24.04:LTSdotnet88.0.132-8.0.32-0ubuntu1~24.04.1USN-8942-1

Affected products (as reported)

VendorProductVersions
Microsoft .NET 10.0 installed on Linux 10.0.0 – before 10.0.403
Microsoft .NET 10.0 installed on Mac OS 10.0.0 – before 10.0.403
Microsoft .NET 10.0 installed on Windows 10.0.0 – before 10.0.403
Microsoft .NET 11.0 installed on Linux 11.0.0-preview.1 – before 11.0.100-rc.3
Microsoft .NET 11.0 installed on Mac OS 11.0.0-preview.1 – before 11.0.100-rc.3
Microsoft .NET 11.0 installed on Windows 11.0.0-preview.1 – before 11.0.100-rc.3
Microsoft Microsoft Visual Studio 2019 version 16.11 16.11.0 – before 16.11.61
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – before 17.14.43
Microsoft Microsoft Visual Studio 2026 version 18.10 18.10.0 – before 18.10.4
Microsoft Microsoft Visual Studio 2026 version 18.11 18.11.0 – before 18.11.2
Microsoft Microsoft Visual Studio 2026 version 18.12 18.12.0 – before 18.12 Insiders 3
Microsoft Microsoft.AspNetCore.Components.WebAssembly.DevServer 11.0.0-preview.1 – before 10.0.14
Microsoft Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 – before 10.0.13

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References