High priorityDisclosed

Advisory · CVE-2026-102870

Code injection in ASP.NET Core WebAssembly server component

ASP.NET Core has a code injection flaw in the WebAssembly server component that a remote attacker can use to execute code when a victim interacts. Microsoft rates it CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
ASP.NET Core
Identifier / CWE
CVE-2026-102870
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

A component meant to serve WebAssembly applications can be made to run the attacker's code instead.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker engages the component

    A remote or authorized attacker sends crafted content or requests to ASP.NET Core.

  2. 02Weakness triggers

    The component mishandles the input and the flaw takes effect.

  3. 03Impact lands

    The attacker gains the execution, elevation, or access the flaw allows.

What happened

Microsoft disclosed CVE-2026-102870 in its October 2026 update guide: a code injection weakness (CWE-94) in ASP.NET Core, with Microsoft’s affected data listing the Microsoft.AspNetCore.Components.WebAssembly.Server package on .NET 10.0 and 11.0 before 10.0.13 for the 10.0 line, plus Visual Studio hosts.

Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every ASP.NET Core deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to ASP.NET Core while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for unexpected code or content in WebAssembly-served applications and crashes in development servers.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Check development and staging servers as well as production: ASP.NET Core flaws often live where the newest framework does.