Security Advisory catalog CVE-2026-102870 CVE-2026-102870 Published
ASP.NET Core Remote Code Execution Vulnerability Overview Affected History Connections
cve-program · CVE-2026-102870 Published .NET 10.0 installed on Linux Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": ".NET 10.0 installed on Linux",
"versions": [
{
"version": "10.0.0",
"lessThan": "10.0.403",
"versionType": "custom",
"status": "affected"
}
]
} .NET 10.0 installed on Mac OS Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": ".NET 10.0 installed on Mac OS",
"versions": [
{
"version": "10.0.0",
"lessThan": "10.0.403",
"versionType": "custom",
"status": "affected"
}
]
} .NET 10.0 installed on Windows Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": ".NET 10.0 installed on Windows",
"versions": [
{
"version": "10.0.0",
"lessThan": "10.0.403",
"versionType": "custom",
"status": "affected"
}
]
} .NET 11.0 installed on Linux Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": ".NET 11.0 installed on Linux",
"versions": [
{
"version": "11.0.0-preview.1",
"lessThan": "11.0.100-rc.3",
"versionType": "custom",
"status": "affected"
}
]
} .NET 11.0 installed on Mac OS Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": ".NET 11.0 installed on Mac OS",
"versions": [
{
"version": "11.0.0-preview.1",
"lessThan": "11.0.100-rc.3",
"versionType": "custom",
"status": "affected"
}
]
} .NET 11.0 installed on Windows Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": ".NET 11.0 installed on Windows",
"versions": [
{
"version": "11.0.0-preview.1",
"lessThan": "11.0.100-rc.3",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Visual Studio 2019 version 16.11 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2019 version 16.11",
"versions": [
{
"version": "16.11.0",
"lessThan": "16.11.61",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Visual Studio 2022 version 17.14 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2022 version 17.14",
"versions": [
{
"version": "17.14.0",
"lessThan": "17.14.43",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Visual Studio 2026 version 18.10 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2026 version 18.10",
"versions": [
{
"version": "18.10.0",
"lessThan": "18.10.4",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Visual Studio 2026 version 18.11 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2026 version 18.11",
"versions": [
{
"version": "18.11.0",
"lessThan": "18.11.2",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Visual Studio 2026 version 18.12 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft Visual Studio 2026 version 18.12",
"versions": [
{
"version": "18.12.0",
"lessThan": "18.12 Insiders 3",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft.AspNetCore.Components.WebAssembly.DevServer Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft.AspNetCore.Components.WebAssembly.DevServer",
"versions": [
{
"version": "11.0.0-preview.1",
"lessThan": "10.0.14",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft.AspNetCore.Components.WebAssembly.Server Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Microsoft.AspNetCore.Components.WebAssembly.Server",
"platforms": [
".NET 10.0 runtime installed on Linux",
".NET 10.0 runtime installed on Mac OS",
".NET 10.0 runtime installed on Windows",
".NET 11.0 runtime installed on Linux",
".NET 11.0 runtime installed on Mac OS",
".NET 11.0 runtime installed on Windows"
],
"versions": [
{
"version": "10.0.0",
"lessThan": "10.0.13",
"versionType": "custom",
"status": "affected"
}
]
}
nvd · CVE-2026-102870 Published No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.
osv · GHSA-g27p-qf6j-c96c Published Microsoft.AspNetCore.Components.WebAssembly.Server NuGet
ECOSYSTEM · introduced 10.0.0 → fixed 10.0.13
13 explicitly affected versions 10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Microsoft.AspNetCore.Components.WebAssembly.Server NuGet
ECOSYSTEM · introduced 11.0.0-preview.1 → fixed 11.0.0-rc.2.26478.115