CVE-2026-102870
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including ToString() results, descriptions, and class names, are embedded in …
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and comp
Affected
- nuget microsoft.aspnetcore.components.webassembly.serverversion unspecified
Sources
- CVE.orgCVE-2026-102870
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-102870
30-day exploitation probability 0.8%
first.org - GitLab Advisory DatabaseCVE-2026-102870
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and comp
advisories.gitlab.com