CVE-2026-102870
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including ToString() results, descriptions, and class names, are embedded in …
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and comp
Affected
- nuget microsoft.aspnetcore.components.webassembly.serverversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-102870
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-102870
30-day exploitation probability 0.8%
first.org - GitLab Advisory DatabasePackage advisoryCVE-2026-102870
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and comp
advisories.gitlab.com