ASP.NET Core EUVD-2026-100325

Exploitation requires an ASP.NET Core application that processes attacker-controlled input through a dynamic code-generation or evaluation path (CWE-94). Per the CVSS vector, the attack is network-reachable (AV:N) and needs no prior authentication (PR:N), but DOES require user interaction (UI:R) - a user or operator must act on the crafted content for the injection to trigger, which is the primary limiting factor and prevents fully autonomous/wormable exploitation. Scope is unchanged (S:U), so impact is confined to the vulnerable application's security context. The specific feature, framework API, or configuration that exposes the injectable code path is not described in the input and should be confirmed against the Microsoft MSRC advisory to determine whether default or only specific configurations are affected.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity code-injection flaw (CWE-94) in ASP.NET Core requiring no privileges but DOES require user interaction (UI:R), which meaningfully tempers the 'unauthenticated RCE' framing. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the elevated score is driven by impact and reachability, not by observed in-the-wild activity. The UI:R requirement is notable: for a web framework, 'user interaction' typically means a victim (often an operator, developer, or authenticated app user) must trigger a crafted request/payload path, so this is not a wormable, fully drive-by remote RCE. Treat this as a genuinely high-priority patch given the ubiquity of ASP.NET Core and full CIA impact, but the absence of EPSS/KEV/POC signals and the UI:R constraint suggest it is not yet a mass-exploitation emergency. The vendor description says 'unauthorized attacker ... over a network,' which is consistent with PR:N; however, the specific injection vector and what the required user interaction entails are not described - verify affected ASP.NET Core versions and the exact trigger with the Microsoft MSRC advisory.

An attacker crafts malicious input that a vulnerable ASP.NET Core application processes in a code-generation/evaluation path, and delivers it via a network request. Because UI:R applies, a user or operator must interact with the crafted content (e.g., follow a link or load a crafted response/page) to trigger the injection, after which attacker-controlled code executes in the application's context. No public exploit code was identified at time of analysis.