CVE-2026-102870

CVE-2026-102870 is a code-injection flaw (CWE-94) in Microsoft ASP.NET Core that lets an unauthorized attacker execute code over a network. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required and complexity is low, but user interaction is required, and successful exploitation can fully compromise confidentiality, integrity, and availability of the affected application. The issue is tracked against the NuGet ecosystem and was assigned by Microsoft. Affected version ranges are not stated in the data provided here. There is no known public proof-of-concept and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Check Microsoft's Security Update Guide and NuGet for the patched ASP.NET Core packages that address CVE-2026-102870, and upgrade every affected application as soon as those updates are identified. Until then, limit network exposure of ASP.NET Core apps and treat unexpected user-influenced code generation or process execution as suspicious. No public proof-of-concept is known and the CVE is not listed in CISA KEV, but the network vector and high impact still warrant prompt patching.