CVE-2026-102870

Summary

This CVE describes a code injection vulnerability in ASP.NET Core that allows remote attackers to execute arbitrary code on affected systems. The flaw occurs when the application improperly handles code generation, creating opportunities for attackers to inject malicious code that gets executed over the network.

Exploitability

Exploitation is moderately difficult as it requires crafting specific input that triggers the code generation process, but once triggered, attackers can execute arbitrary code with the privileges of the affected application.

Blast radius

The impact could be significant across web applications using ASP.NET Core, potentially allowing attackers to compromise entire web servers and access sensitive data or perform unauthorized operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ASP.NET Core 8.0.1 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.