Key points
- CVE-2026-102870 affects Visual Studio 2022 and 2026 versions prior to specific patch levels.
- The Microsoft.AspNetCore.Components.WebAssembly.Server package versions below 10.0.13 are vulnerable.
- Patches are available for all affected Visual Studio versions and NuGet packages.
Microsoft has released patches for a remote code execution vulnerability in the ASP.NET Core debugger. The flaw, tracked as CVE-2026-102870, allows unauthorized attackers to execute code over a network. This issue affects developers using specific versions of Visual Studio and the Blazor WebAssembly server component. Patches are now available for all affected software versions.
In plain English
The vulnerability exists in the Blazor WebAssembly debug proxy. This tool generates and compiles C# source code to evaluate debugger expressions. Certain values from the application being debugged are embedded in this generated source without consistent escaping. An attacker can control these values to escape the generated string literal. This allows code execution on the developer's machine when they evaluate an expression during debugging.
The background
The issue is rated high severity with a CVSS score of 8.8. It is classified as improper control of generation of code, also known as code injection, under CWE-94. The flaw affects Windows, Linux, and macOS platforms across all architectures. It impacts Microsoft Visual Studio 2022 version 17.14 before 17.14.42 and Visual Studio 2026 version 18.10 before 18.10.4. The Microsoft.AspNetCore.Components.WebAssembly.Server package is also affected in versions before 10.0.13.
What changes now
Developers must update their environments to remove this vulnerability. Microsoft provides guidance on updating applications to address the issue. The patched version for the server package is 10.0.13 for the 10.0 branch. For the 11.0 preview branch, the patched version is 11.0.0-rc.2.26478.115. Teams should verify their current versions against these patched releases.
Who needs to act first
Security operations teams should prioritize updating developer workstations that use the affected Visual Studio versions. Start with systems exposed to untrusted networks or those debugging unverified applications. Test the updated debugger in a isolated environment before rolling out changes broadly. Back up critical project configurations prior to applying updates. If immediate patching is not possible, restrict debugger access to trusted internal networks only. Monitor for unusual process executions on developer machines.
What to do and how to stay safe: Microsoft
- Audit inventory for Visual Studio 2022 and 2026 versions to identify unpatched installations.
- Update the Microsoft.AspNetCore.Components.WebAssembly.Server NuGet package to the latest patched version.
- Restrict debugger usage to trusted networks until all workstations are updated.
- Monitor developer machines for unexpected code execution or new processes.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Visual Studio versions are affected by CVE-2026-102870?
Visual Studio 2022 version 17.14 before 17.14.42 and Visual Studio 2026 version 18.10 before 18.10.4 are affected.
Is there a fix available for the Blazor WebAssembly debugger flaw?
Yes, patches are available for Visual Studio and the Microsoft.AspNetCore.Components.WebAssembly.Server package.
What is the CVSS score for this vulnerability?
The CVSS 3.1 score is 8.8, which is rated as high severity.
