CVE-2026-102870: ASP.NET Core Remote Code Execution Vulnerability

Rated Important with a CVSS base score of 8.8 and a CVSS temporal score of 7.7, the vulnerability affects Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, and the Microsoft.AspNetCore.Components.WebAssembly.Server package. Because developer workstations frequently hold elevated local permissions, source code access, and cloud deployment credentials, securing the tools used to build and inspect applications is just as critical as securing production servers.

Vulnerability Overview: CVE-2026-102870​

According to the Microsoft Security Response Center (MSRC) advisory, the core issue stems from improper control of generation of code ('code injection') in ASP.NET Core, tracked under weakness identifier CWE-94. Specifically, Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Here are the verified technical metrics and status indicators from Microsoft's advisory:

• CVE ID: CVE-2026-102870
• Title: ASP.NET Core Remote Code Execution Vulnerability
• Severity: Important
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-94
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

How Exploitation Works During Debugging​

What makes CVE-2026-102870 particularly noteworthy for software engineering teams is the exact scenario required to trigger it. Rather than targeting a passive production web server without human intervention, this flaw targets an active debugging workflow.

In its official advisory FAQ ("How could an attacker exploit this vulnerability?"), Microsoft explains the exact mechanism: an unauthenticated attacker could supply specially crafted data to an application being debugged. If a developer evaluates an affected object during a Blazor WebAssembly debugging session, successful exploitation could allow the attacker to execute code in the developer's context. User interaction is required.

This aligns directly with the CVSS vector breakdown (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H):

• Attack Vector: Network (AV:N) and Privileges Required: None (PR:N) reflect that an unauthenticated attacker can deliver the specially crafted input over a network to the target application being debugged.
• Attack Complexity: Low (AC:L) indicates that preparing the crafted payload does not depend on complex external race conditions beyond the required interaction.
• User Interaction: Required (UI:R) reflects the need for the developer to actively evaluate the affected object while debugging a Blazor WebAssembly session.
• High Impact to Confidentiality, Integrity, and Availability (C:H/I:H/A:H) within an unchanged scope (S:U) underscores that once triggered, the injected code executes directly inside the developer's user context.

From a general industry security perspective, developer-targeted vulnerabilities deserve careful attention whenever teams debug applications exposed to untrusted network traffic, shared staging payloads, or third-party test webhooks. Inspecting variables and evaluating objects in a debugger is muscle memory for any .NET engineer—meaning the "user interaction" hurdle is a normal part of daily diagnostic work if untrusted data reaches a debugged instance.

Section Summary: CVE-2026-102870 is an Important-severity CWE-94 code injection flaw (CVSS 8.8 base, 7.7 temporal) in ASP.NET Core that can lead to remote code execution in a developer's context if an affected object containing attacker-crafted data is evaluated during a Blazor WebAssembly debugging session.

Affected Products, Fixed Builds, and Remediation​

Microsoft has released official fixes across both affected Visual Studio releases and the underlying ASP.NET Core Blazor WebAssembly server component. Because Customer action required: Yes applies to this release, developers and enterprise IT administrators managing Visual Studio installations and NuGet package dependencies must apply the updates below.

Exact Remediation Guidance​

To ensure full protection against CVE-2026-102870, verify your environment against Microsoft's exact remediation instructions:

• For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.42 or later.
• For Microsoft Visual Studio 2026 version 18.10, update to fixed build 18.10.4 or later.
• For Microsoft.AspNetCore.Components.WebAssembly.Server, update to fixed build 10.0.13 or later; update to fixed build 11.0.0-rc.2.26478.115 or later.

Actionable Guidance for Developers and IT Admins​

Addressing a vulnerability that spans both integrated development environments (IDEs) and application framework packages requires coordination between endpoint administrators and software development teams:

1. Update Visual Studio Instances: Use the Visual Studio Installer or enterprise endpoint management tooling to bring all installations of Microsoft Visual Studio 2022 version 17.14 up to build 17.14.42 (or later) and Microsoft Visual Studio 2026 version 18.10 up to build 18.10.4 (or later).
2. Audit Blazor WebAssembly Project Dependencies: Inspect solution files and .csproj manifests across your repositories for references to Microsoft.AspNetCore.Components.WebAssembly.Server. Update package references to fixed build 10.0.13 or later, or 11.0.0-rc.2.26478.115 or later, and commit the updated lock files so every developer pulls the patched dependency before starting a local debugging session.
3. Isolate Debugging Environments: As a defense-in-depth practice synthesized from standard application security principles, avoid exposing active Blazor WebAssembly debugging sessions to untrusted network inputs or external traffic prior to patching both your IDE and project packages.

Section Summary: Resolving CVE-2026-102870 requires updating Microsoft Visual Studio 2022 version 17.14 to build 17.14.42 or later, updating Microsoft Visual Studio 2026 version 18.10 to build 18.10.4 or later, and updating the Microsoft.AspNetCore.Components.WebAssembly.Server package to build 10.0.13 or later, or 11.0.0-rc.2.26478.115 or later.