ASP.NET Core CVE-2026-96230

Exploitation requires an application built on the affected ASP.NET Core Blazor WebAssembly Server component (Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 to <10.0.13, or apps produced by the vulnerable Visual Studio 2026 18.10.x and 2022 17.14.x toolchains) that renders attacker-influenced input into a web page without proper HTML encoding/neutralization. The key limiting factor is mandatory user interaction (CVSS UI:R): a victim must load or interact with the attacker-crafted content in a browser for the script to execute. No attacker authentication is required (PR:N) and the attack is network-delivered (AV:N), but SSVC marks it non-automatable, so each compromise depends on social delivery to and interaction by a target user rather than mass scanning.

This is a CWE-79 cross-site scripting flaw in ASP.NET Core (specifically the Microsoft.AspNetCore.Components.WebAssembly.Server hosting component and the Visual Studio toolchain that ships it). The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated issue requiring user interaction, with Microsoft rating full confidentiality/integrity/availability impact. These signals conflict with the typical XSS profile and with CISA's SSVC read: SSVC records Exploitation=none, Automatable=no, Technical Impact=total. The 'Automatable=no' and 'UI:R' both indicate exploitation is not scalable/wormable and depends on luring a victim, while 'Technical Impact=total' aligns with Microsoft's C:H/I:H/A:H. There is no EPSS score provided, no CISA KEV listing, and no POC referenced - so by the precision rules this is 'no public exploit identified at time of analysis.' Net: a genuinely high-severity vulnerability in very widely used Microsoft web technology and a worthwhile patch priority, but current real-world urgency is tempered by the absence of known exploitation, the non-automatable nature, and the mandatory user interaction. Note also a signal tension worth verifying with the vendor: the description phrases this as an attacker able to 'execute code over a network,' and Microsoft scores it C:H/I:H/A:H with scope unchanged (S:U), which is unusually high for a classic reflected/stored XSS - independent assessors frequently score XSS lower and with a scope change, so treat the 'total impact' rating as vendor-assigned rather than independently confirmed.

An attacker crafts malicious input (e.g., a link or data field) that an ASP.NET Core / Blazor WebAssembly Server application renders into a web page without proper neutralization. When a victim user interacts with the crafted content in their browser, the injected script executes in the application's context, allowing session/data theft or actions on the user's behalf. No authentication is required of the attacker per the CVSS vector (PR:N), but victim interaction (UI:R) is mandatory; no public exploit code has been identified at time of analysis.