p PatchFirst

CVE-2026-102870

CVE-2026-102870 · ASP.NET Core Remote Code Execution Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 8.8 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • .net 10.0 installed on linux

    Versions
    • ≥ 10.0.0, < 10.0.403: Affected (custom)

    Update to 10.0.403

  • .net 10.0 installed on mac os

    Versions
    • ≥ 10.0.0, < 10.0.403: Affected (custom)

    Update to 10.0.403

  • .net 10.0 installed on windows

    Versions
    • ≥ 10.0.0, < 10.0.403: Affected (custom)

    Update to 10.0.403

  • .net 11.0 installed on linux

    Versions
    • ≥ 11.0.0-preview.1, < 11.0.100-rc.3: Affected (custom)

    Update to 11.0.100-rc.3

  • .net 11.0 installed on mac os

    Versions
    • ≥ 11.0.0-preview.1, < 11.0.100-rc.3: Affected (custom)

    Update to 11.0.100-rc.3

  • .net 11.0 installed on windows

    Versions
    • ≥ 11.0.0-preview.1, < 11.0.100-rc.3: Affected (custom)

    Update to 11.0.100-rc.3

  • microsoft visual studio 2019 version 16.11

    Versions
    • ≥ 16.11.0, < 16.11.61: Affected (custom)

    Update to 16.11.61

  • microsoft visual studio 2022 version 17.14

    Versions
    • ≥ 17.14.0, < 17.14.43: Affected (custom)

    Update to 17.14.43

  • microsoft visual studio 2026 version 18.10

    Versions
    • ≥ 18.10.0, < 18.10.4: Affected (custom)

    Update to 18.10.4

  • microsoft visual studio 2026 version 18.11

    Versions
    • ≥ 18.11.0, < 18.11.2: Affected (custom)

    Update to 18.11.2

  • microsoft visual studio 2026 version 18.12

    Versions
    • ≥ 18.12.0, < 18.12 Insiders 3: Affected (custom)

    No fix published

  • microsoft.aspnetcore.components.webassembly.devserver

    Versions
    • ≥ 11.0.0-preview.1, < 10.0.14: Affected (custom)

    No fix published

  • microsoft.aspnetcore.components.webassembly.server

    Versions
    • ≥ 10.0.0, < 10.0.13: Affected (custom)

    Update to 10.0.13

  • dotnet6 Ubuntu:22.04:LTS

    Versions
    • 6.0.108-0ubuntu1~22.04.1
    • 6.0.109-0ubuntu1~22.04.1
    • 6.0.110-0ubuntu1~22.04.1
    • 6.0.111-0ubuntu1~22.04.1
    • 6.0.113-0ubuntu1~22.04.1
    • 6.0.116-0ubuntu1~22.04.1
    • 6.0.118-0ubuntu1~22.04.1
    • 6.0.119-0ubuntu1~22.04.1
    • 6.0.120-0ubuntu1~22.04.1
    • 6.0.121-0ubuntu1~22.04.1
    • 6.0.122-0ubuntu1~22.04.1
    • 6.0.123-0ubuntu1~22.04.1
    • 6.0.124-0ubuntu1~22.04.1
    • 6.0.125-0ubuntu1~22.04.1
    • 6.0.126-0ubuntu1~22.04.1
    • 6.0.127-0ubuntu1~22.04.1
    • 6.0.128-0ubuntu1~22.04.2
    • 6.0.132-0ubuntu1~22.04.1
    • 6.0.133-0ubuntu1~22.04.1
    • 6.0.135-0ubuntu1~22.04.1
    • 6.0.136-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dotnet7 Ubuntu:22.04:LTS

    Versions
    • 7.0.105-0ubuntu1~22.04.1
    • 7.0.107-0ubuntu1~22.04.1
    • 7.0.108-0ubuntu1~22.04.1
    • 7.0.109-0ubuntu1~22.04.1
    • 7.0.110-0ubuntu1~22.04.1
    • 7.0.111-0ubuntu1~22.04.1
    • 7.0.112-0ubuntu1~22.04.1
    • 7.0.113-0ubuntu1~22.04.1
    • 7.0.114-0ubuntu1~22.04.1
    • 7.0.115-0ubuntu1~22.04.1
    • 7.0.116-0ubuntu1~22.04.1
    • 7.0.117-0ubuntu1~22.04.1
    • 7.0.117-0ubuntu1~22.04.2
    • 7.0.119-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dotnet10 Ubuntu:24.04:LTS

    Versions
    • 10.0.100-10.0.0-0ubuntu1~24.04.1
    • 10.0.101-10.0.1-0ubuntu1~24.04.2
    • 10.0.103-10.0.3-0ubuntu1~24.04.1
    • 10.0.104-10.0.4-0ubuntu1~24.04.1
    • 10.0.105-10.0.5-0ubuntu1~24.04.1
    • 10.0.106-10.0.6-0ubuntu1~24.04.1
    • 10.0.107-10.0.7-0ubuntu1~24.04.1
    • 10.0.108-10.0.8-0ubuntu1~24.04.1
    • 10.0.109-10.0.9-0ubuntu1~24.04.1
    • 10.0.110-10.0.10-0ubuntu1~24.04.1
    • 10.0.111-10.0.11-0ubuntu1~24.04.1
    • 10.0.112-10.0.12-0ubuntu1~24.04.1
    Affected ranges
    • ECOSYSTEM: < 10.0.113-10.0.13-0ubuntu1~24.04.1

    Update to 10.0.113-10.0.13-0ubuntu1~24.04.1

  • dotnet10 Ubuntu:26.10

    Versions
    • 10.0.105-10.0.5-0ubuntu1
    • 10.0.107-10.0.7-0ubuntu1~26.04.1
    • 10.0.108-10.0.8-0ubuntu1
    • 10.0.109-10.0.9-0ubuntu1
    • 10.0.110-10.0.10-0ubuntu3
    • 10.0.111-10.0.11-0ubuntu1
    • 10.0.112-10.0.12-0ubuntu1
    • 10.0.112-10.0.12-0ubuntu2
    Affected ranges
    • ECOSYSTEM: < 10.0.113-10.0.13-0ubuntu1~26.10.1

    Update to 10.0.113-10.0.13-0ubuntu1~26.10.1

  • dotnet11 Ubuntu:26.10

    Versions
    • 11.0.100-11.0.0~rc1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1

    Update to 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1

  • dotnet10 Ubuntu:26.04:LTS

    Versions
    • 10.0.100-10.0.0~rc1-0ubuntu1
    • 10.0.100-10.0.0~rc2-0ubuntu1
    • 10.0.100-10.0.0-0ubuntu1
    • 10.0.100-10.0.0-0ubuntu2
    • 10.0.101-10.0.1-0ubuntu1
    • 10.0.101-10.0.1-0ubuntu2
    • 10.0.101-10.0.1-0ubuntu3
    • 10.0.102-10.0.2-0ubuntu1
    • 10.0.103-10.0.3-0ubuntu1
    • 10.0.104-10.0.4-0ubuntu1
    • 10.0.105-10.0.5-0ubuntu1
    • 10.0.107-10.0.7-0ubuntu1~26.04.1
    • 10.0.108-10.0.8-0ubuntu1~26.04.1
    • 10.0.109-10.0.9-0ubuntu1~26.04.1
    • 10.0.110-10.0.10-0ubuntu1~26.04.1
    • 10.0.111-10.0.11-0ubuntu1~26.04.1
    • 10.0.112-10.0.12-0ubuntu1~26.04.1
    Affected ranges
    • ECOSYSTEM: < 10.0.113-10.0.13-0ubuntu1~26.04.1

    Update to 10.0.113-10.0.13-0ubuntu1~26.04.1

Original sources

Check your server →