Skip to content
Multiple Vulnerabilities in ASP.NET Core Disclosed

Multiple Vulnerabilities in ASP.NET Core Disclosed

First seen 13 Nov 2026, 21:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 13, 2026 at 21:19 UTC
  • •CVE-2026-109481 allows cross-site request vulnerabilities in Blazor/SignalR.
  • •GHSA-67wp-ghc2-fw2g enables injected messages to execute Hub invocations.
  • •Both vulnerabilities affect ASP.NET Core across multiple platforms.

Microsoft has released two security advisories for vulnerabilities in ASP.NET Core affecting various versions. The first, CVE-2026-109481, involves a cross-site request vulnerability in the Blazor/SignalR refresh path, allowing an attacker to bind a victim's authenticated principal to their own circuit. The second advisory, GHSA-67wp-ghc2-fw2g, details a vulnerability in SignalR connections that allows injected messages to execute Hub invocations as the victim. Both vulnerabilities affect platforms including Windows, Linux, and macOS. Users are advised to check their deployed runtime and application package versions against the affected ranges and apply the necessary updates. The first CVE has a CVSS score of 7.5, while the second has a score of 9.0, indicating a severity level. Patches are available for the affected versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-11-10
CVE-2026-109481 published
Microsoft disclosed a cross-site request vulnerability in ASP.NET Core affecting Blazor/SignalR.
Article 2
2026-11-13
GHSA-67wp-ghc2-fw2g advisory released
Microsoft announced a critical vulnerability in SignalR connections allowing message injection.
Article 1

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109481 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

What are the affected ASP.NET Core versions?
ASP.NET Core 2.3, .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11.0 are affected.
How critical are these vulnerabilities?
The vulnerabilities have CVSS scores of 9.0 and 7.5, indicating critical and high severity respectively.
What steps should I take to mitigate these issues?
Check your application and runtime versions against the advisory, and apply the necessary updates immediately.