Zero Radar
← feed
HighVulnerabilityCVE-2026-102870updated 29 Oct 2026, 20:46 UTC

ASP.NET Core Blazor WebAssembly server can run attacker code over the network

A flaw in the ASP.NET Core development tooling used with Blazor WebAssembly lets an outside attacker send crafted input that makes the server run their code. Websites built on this framework can be taken over if they run the affected versio

Fix availableOfficial, 4 sources
SeverityHighCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesMicrosoft.AspNetCore.Components.WebAssembly.Server 10.0.13; 11.0.0-rc.2.26478.115 · since 25 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends crafted inputReaches the Blazor debug proxy over the network
  2. 2Unescaped value processedProxy fails to escape certain values
  3. 3Code injected into serverAttacker input is treated as code
  4. 4Arbitrary code runsExecutes with the server's privileges
  5. ResultAttacker runs code on the server

What happened

The Blazor WebAssembly debug proxy in ASP.NET Core does not properly escape certain values, enabling code injection (CWE-94) that allows unauthorized remote code execution over the network. An earlier fix in USN-8942-1 was incomplete.

Why it is dangerous: An attacker who can reach the affected server over the network could execute arbitrary code, potentially gaining full control of the application host. Any team running the affected Blazor WebAssembly server package is at risk.

Are you affected?

You are affected if your project uses Microsoft.AspNetCore.Components.WebAssembly.Server version 10.0.0 to before 10.0.13, or 11.0.0-preview.1 to before 11.0.0-rc.2.26478.115.

Package / productAffected versionsFixed in
Microsoft.AspNetCore.Components.WebAssembly.Server · nuget>= 10.0.0, < 10.0.1310.0.13
Microsoft.AspNetCore.Components.WebAssembly.Server · nuget>= 11.0.0-preview.1, < 11.0.0-rc.2.26478.11511.0.0-rc.2.26478.115

What to do

  1. Update Microsoft.AspNetCore.Components.WebAssembly.Server to 10.0.13 or later on the 10.x line
  2. Update to 11.0.0-rc.2.26478.115 or later on the 11.x preview line
  3. On Ubuntu, install the latest .NET security updates from USN-8958-1, since the earlier fix was incomplete
  4. Rebuild and redeploy the application after updating

Timeline

  1. 13 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 25 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 25 Oct 2026, 17:08 UTC
    Picked up by Zero Radar
  4. 25 Oct 2026, 18:20 UTC
    NVD reported on it · NVD
  5. 25 Oct 2026, 18:35 UTC
    OSV reported on it · OSV
  6. 25 Oct 2026, 18:35 UTC
    Fixed version published: Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13, Microsoft.AspNetCore.Components.WebAssembly.Server 11.0.0-rc.2.26478.115 · OSV
  7. 25 Oct 2026, 18:36 UTC
    Fix: 10.0.13; 11.0.0-rc.2.26478.115
  8. 29 Oct 2026, 20:46 UTC
    Ubuntu Security reported on it · Ubuntu Security

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102870
CVSS
8.8 / 10
EPSS
0.9% chance of exploitation within 30 days
Disclosed
13 Oct 2026, 19:17 UTC
On Zero Radar
25 Oct 2026, 17:08 UTC (12 days after disclosure)
Last change
29 Oct 2026, 20:46 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ASP.NET Core Blazor WebAssembly server can run attacker code over the network · Zero Radar