CVE-2026-102870high8.8
ASP.NET Core Remote Code Execution Vulnerability
Impact
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Source excerpt · microsoftAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Microsoft · .NET 10.0 installed on Linux
| Version / range | Source status |
|---|---|
| 10.0.0 to before 10.0.403 | affected |
Microsoft · .NET 10.0 installed on Mac OS
| Version / range | Source status |
|---|---|
| 10.0.0 to before 10.0.403 | affected |
Microsoft · .NET 10.0 installed on Windows
| Version / range | Source status |
|---|---|
| 10.0.0 to before 10.0.403 | affected |
Microsoft · .NET 11.0 installed on Linux
| Version / range | Source status |
|---|---|
| 11.0.0-preview.1 to before 11.0.100-rc.3 | affected |
Microsoft · .NET 11.0 installed on Mac OS
| Version / range | Source status |
|---|---|
| 11.0.0-preview.1 to before 11.0.100-rc.3 | affected |
Microsoft · .NET 11.0 installed on Windows
| Version / range | Source status |
|---|---|
| 11.0.0-preview.1 to before 11.0.100-rc.3 | affected |
Microsoft · Microsoft Visual Studio 2019 version 16.11
| Version / range | Source status |
|---|---|
| 16.11.0 to before 16.11.61 | affected |
Microsoft · Microsoft Visual Studio 2022 version 17.14
| Version / range | Source status |
|---|---|
| 17.14.0 to before 17.14.43 | affected |
Microsoft · Microsoft Visual Studio 2026 version 18.10
| Version / range | Source status |
|---|---|
| 18.10.0 to before 18.10.4 | affected |
Microsoft · Microsoft Visual Studio 2026 version 18.11
| Version / range | Source status |
|---|---|
| 18.11.0 to before 18.11.2 | affected |
Microsoft · Microsoft Visual Studio 2026 version 18.12
| Version / range | Source status |
|---|---|
| 18.12.0 to before 18.12 Insiders 3 | affected |
Microsoft · Microsoft.AspNetCore.Components.WebAssembly.DevServer
| Version / range | Source status |
|---|---|
| 11.0.0-preview.1 to before 10.0.14 | affected |
Microsoft · Microsoft.AspNetCore.Components.WebAssembly.Server
Platforms: .NET 10.0 runtime installed on Linux, .NET 10.0 runtime installed on Mac OS, .NET 10.0 runtime installed on Windows, .NET 11.0 runtime installed on Linux, .NET 11.0 runtime installed on Mac OS, .NET 11.0 runtime installed on Windows
| Version / range | Source status |
|---|---|
| 10.0.0 to before 10.0.13 | affected |
Original source description
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.