CVE-2026-96230

Опубликовано: 13 окт. 2026

Источник: msrc

CVSS3: 8.8

EPSS Низкий

Описание

ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

FAQ

How could an attacker exploit this vulnerability?

An unauthenticated attacker could host a specially crafted web page and convince a developer to visit it. The page could send requests to a vulnerable development server running on the developer's system, and successful exploitation could allow the attacker to execute code in the developer's context. User interaction is required.

Обновления

Продукт	Статья	Обновление
Microsoft Visual Studio 2022 version 17.14	Release Notes	Security Update
Microsoft Visual Studio 2026 version 18.10	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 runtime installed on Windows	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 runtime installed on Linux	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 runtime installed on Mac OS	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 runtime installed on Windows	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 runtime installed on Linux	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 runtime installed on Mac OS	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 runtime installed on Windows	Release Notes	Security Update
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 runtime installed on Linux	Release Notes	Security Update

Показывать по

Возможность эксплуатации

Publicly Disclosed

Exploited

Latest Software Release

Exploitation Less Likely

EPSS

Процентиль: 61%

0.00946

Низкий

8.8 High

CVSS3

Связанные уязвимости

CVE-2026-96230

CVSS3: 8.8

ubuntu

14 дней назад

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVE-2026-96230

CVSS3: 8.8

redhat

13 дней назад

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVE-2026-96230

CVSS3: 8.8

nvd

13 дней назад

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

GHSA-qjpx-jqm5-h2c4

CVSS3: 8.8

github

13 дней назад

Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

RLSA-2026:86172

rocky

5 дней назад

Critical: .NET 9.0 security, bug fix, and enhancement update

EPSS

Процентиль: 61%

0.00946

Низкий

8.8 High

CVSS3