CVE-2026-96230: ASP.NET Core XSS Vulnerability

CVE-2026-96230 Overview

CVE-2026-96230 is a cross-site scripting (XSS) vulnerability in ASP.NET Core that allows an unauthenticated attacker to execute code over a network. The flaw stems from improper neutralization of input during web page generation [CWE-79]. Successful exploitation requires user interaction, such as clicking a crafted link or visiting an attacker-controlled page. The vulnerability affects the confidentiality, integrity, and availability of impacted systems. Microsoft published the advisory on October 13, 2026.

Critical Impact
An unauthorized remote attacker can execute code in the context of a vulnerable ASP.NET Core web application after a user interaction, potentially leading to full compromise of the targeted session or host.

Affected Products

ASP.NET Core (version details per Microsoft advisory)
Web applications built on affected ASP.NET Core runtime versions
Microsoft-maintained ASP.NET Core components referenced in the vendor update

Discovery Timeline

2026-10-13 - CVE-2026-96230 published to NVD
2026-10-13 - Microsoft Security Response Center advisory released
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-96230

Vulnerability Analysis

The vulnerability resides in how ASP.NET Core generates web page output. Input from an attacker-controlled source reaches the response without proper encoding or sanitization. A browser then interprets the untrusted content as executable script within the application's origin.

Because the attack vector is network-based and requires no privileges, an attacker can deliver the payload through a crafted URL, form submission, or embedded resource. The user interaction requirement is typically satisfied by clicking a link or loading a malicious page. Successful exploitation yields code execution with the user's authenticated context in the application.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. ASP.NET Core fails to encode or validate certain user-controlled values before rendering them into the HTML, JavaScript, or attribute context of a response. This allows script content supplied by the attacker to be interpreted as code by the victim's browser.

Attack Vector

An attacker crafts a malicious payload embedded in a request parameter, header, or stored field consumed by a vulnerable ASP.NET Core endpoint. The attacker then lures an authenticated or unauthenticated user to trigger the reflected or stored payload. Once rendered, the injected script runs with the privileges of the victim within the application's origin. This can lead to session theft, credential capture, or further code execution against the application backend. Refer to the Microsoft Vulnerability Update CVE-2026-96230 for exploitability guidance.

No public proof-of-concept or exploit code has been published at the time of writing.

Detection Methods for CVE-2026-96230

Indicators of Compromise

Web server access logs containing script tags, javascript: URIs, or encoded payloads such as %3Cscript%3E in query strings or form fields.
Outbound requests from browser sessions to unexpected external domains following interaction with ASP.NET Core applications.
Unexpected creation of authentication tokens, session cookies, or API calls originating from legitimate user sessions.

Detection Strategies

Inspect HTTP request and response bodies for reflected unsanitized input containing HTML or JavaScript constructs.
Deploy a web application firewall (WAF) with XSS rule sets tuned for ASP.NET Core routes and model binding patterns.
Correlate browser-side Content Security Policy (CSP) violation reports with server access logs to identify injection attempts.

Monitoring Recommendations

Enable detailed request logging on ASP.NET Core applications and forward logs to a centralized analytics platform.
Monitor for anomalous user-agent behavior, elevated 4xx/5xx error rates, and repeated requests to the same endpoint with varied payloads.
Alert on CSP report-uri submissions indicating blocked inline script execution.

How to Mitigate CVE-2026-96230

Immediate Actions Required

Apply the Microsoft security update for ASP.NET Core as described in the Microsoft Vulnerability Update CVE-2026-96230 advisory.
Inventory all applications using ASP.NET Core and prioritize patching internet-facing services.
Review recent web server logs for signs of exploitation attempts targeting affected endpoints.

Patch Information

Microsoft has released an official update addressing CVE-2026-96230. Administrators should consult the Microsoft Security Response Center advisory for the specific package versions, NuGet references, and runtime builds that remediate the vulnerability. Update both the .NET runtime and any bundled ASP.NET Core libraries used by the application.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Apply output encoding using built-in ASP.NET Core Razor helpers and avoid Html.Raw for untrusted data.
Deploy WAF rules that block common XSS payloads targeting known ASP.NET Core routes until patching completes.

bash

# Update the .NET SDK and runtime to the patched release
dotnet --list-sdks
dotnet --list-runtimes

# Example: upgrade a project to the patched ASP.NET Core package
dotnet add package Microsoft.AspNetCore.App --version <patched-version>
dotnet restore
dotnet build