Microsoft ASP.NET Core: Cross-site request forgery in Blazor Server
Summary
A cross-site request forgery (CSRF) vulnerability in ASP.NET Core allows an unauthenticated network attacker to elevate privileges. The affected component is the Blazor Server circuit endpoint, which Microsoft's sources describe as able to accept a cross-site request that binds a victim's authenticated session to an attacker-controlled circuit. Exploitation requires a victim with an active authenticated session to visit an attacker-controlled page (CVSS UI:R, AC:H).
Affected
- .NET 11 on Linux, macOS and Windows: per the CVE record 11.0.0-preview.1 up to before 11.0.0. The GitHub/GitLab advisory mirror lists 11.0.0-preview.6.26359.118 up to before 11.0.0. This conflict is unresolved; verify on MSRC.
- Visual Studio 2026 version 18.12: 18.12.0 according to the CVE record. Unresolved, verify on MSRC.
- .NET 8, 9 and 10: no evidence of impact found, but no explicit 'not affected' statement.
Fixed in
- .NET 11.0.0 or later.
- Visual Studio 2026 18.12: fixed version unknown, check MSRC.
Workaround
Unknown. Microsoft documents no workaround; the vendor advises upgrading.
- Unverified third-party suggestion: reject requests with a Sec-Fetch-Site header set to cross-site or none. This is not confirmed by the vendor and may break legitimate flows, so test it first.
Exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog; no evidence of active exploitation found.
- Public proof of concept: unknown.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory .NET 11 preview or RC installations and Visual Studio 2026 18.12 installations.
- Upgrade to .NET 11.0.0 or later and redeploy self-contained applications, because they embed their own runtime.
- Prioritise internet-facing Blazor Server applications with logged-in users.
- Check whether other November 2026 ASP.NET Core advisories affect your stack.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-109481 msrc.microsoft.com
- CVE Record CVE-2026-109481 (CNA: Microsoft) www.cve.org
- .NET and .NET Framework November 2026 servicing updates devblogs.microsoft.com
- dotnet announcements issue 504 github.com
- GitLab advisory mirror: microsoft.aspnetcore.app.runtime.osx-x64 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:04.
Original description (NVD)
Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.