CVE-2026-96230: cross-site scripting in the ASP.NET Core Blazor WebAssembly development-server debug page, rated as remote code execution (CVSS 8.8)
CVE-2026-102870 CVE-2026-109468 CVE-2026-114148 CVE-2026-70159 CVE-2026-70175 CVE-2026-70179 CVE-2026-70181 CVE-2026-70183 CVE-2026-70186 CVE-2026-70188 CVE-2026-70196 CVE-2026-88092 CVE-2026-96230 CVE-2026-96233 CVE-2026-96236
Published 27/10/2026 11:00
Timeline
2 events over 13 d
- 13/10/2026 16:00ConfirmedMicrosoft Security Update Guide+13 d
- 27/10/2026 11:00Published on WatchtowerPro CISO
In short
Microsoft released security fixes for ASP.NET Core on 13/10/2026, including remote code execution, privilege escalation and denial-of-service flaws, and published a further local privilege escalation flaw on 25/10/2026. Update to the fixed versions for your .NET release line and recompile self-contained applications. No attacks in the wild have been reported. Shodan estimates about 2.7 million internet-facing ASP.NET servers worldwide, 499,166 of them in the EU (27/10/2026); how many run an affected version is not yet known.
How bad is it
High. An attacker who can reach it over the internet can run their own code on it, without logging in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 15 CVEs · CVSS 3.1 from NVD, from microsoft.com, read 27/10/2026. CVE-2026-114148, CVE-2026-70175, CVE-2026-70188, CVE-2026-70196, CVE-2026-88092, CVE-2026-96233, CVE-2026-96236: no score published yet.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Microsoft.AspNetCore.Components.WebAssembly.Server on Windows, Linux and macOS, all architectures.
- .NET 8.0: versions 8.0.0 to 8.0.31.
- .NET 9.0: versions 9.0.0 to 9.0.20.
- .NET 10.0: versions 10.0.0 to 10.0.12.
- .NET 11.0 (preview): versions 11.0.0-preview.1 to 11.0.0-rc.1.
- Self-contained apps that target an affected version stay vulnerable until they are recompiled and redeployed.
Fixed in
- 8.0 branch: 8.0.32
- 9.0 branch: 9.0.21
- 10.0 branch: 10.0.13
- 11.0 branch: 11.0.0-rc.2
What to do now
- Install the patched .NET SDK or runtime for your branch: .NET 8.0 → runtime 8.0.32 / SDK 8.0.426; .NET 9.0 → runtime 9.0.21 / SDK 9.0.319; .NET 10.0 → runtime 10.0.13 / SDK 10.0.402; .NET 11.0 preview → runtime 11.0.0-rc.2 / SDK 11.0.100-rc.2. Visual Studio users get the fix through the Visual Studio update.
- Update the Microsoft.AspNetCore.Components.WebAssembly.Server package reference in every project to the fixed version for its branch: 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2.
- Restart all running apps after updating. Recompile and redeploy self-contained apps; they stay vulnerable until rebuilt against the fixed version.
- If a build fails with NuGet warning NU1903 (when warnings are treated as errors), the project still references a vulnerable version. Move it to the fixed version; do not suppress the warning.
- Microsoft gives no interim workaround for this vulnerability. Updating is the only vendor-provided fix, so do not delay it while waiting for an alternative.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 12 sources with their dates. And technology matching: which of your systems run ASP.NET, at which version, fixed or not - and what each one needs.
Main sources
CVE-2026-70183 ASP.NET Core Elevation of Privilege Vulnerability Vendor · CVE-2026-88092 ASP.NET Core Tampering Vulnerability Vendor · CVE-2026-96230 ASP.NET Core Remote Code Execution Vulnerability Vendor