Detections
Analytics
Security Update for Microsoft ASP.NET Core (October 2026)
critical Nessus Plugin ID 366548
Language:
Synopsis
The Microsoft ASP.NET installations on the remote host are affected by multiple vulnerabilities.Description
The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.- Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)
- Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. (CVE-2026-88092)
- Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. (CVE-2026-96230)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update ASP.NET Core, remove vulnerable packages and refer to vendor advisory.See Also
https://dotnet.microsoft.com/download/dotnet/10.0
https://dotnet.microsoft.com/download/dotnet/8.0
https://dotnet.microsoft.com/download/dotnet/9.0
https://github.com/dotnet/announcements/issues/452
https://github.com/dotnet/announcements/issues/457
https://github.com/dotnet/announcements/issues/458
https://github.com/dotnet/announcements/issues/459
https://github.com/dotnet/announcements/issues/460
https://github.com/dotnet/announcements/issues/461
https://github.com/dotnet/announcements/issues/462
https://github.com/dotnet/announcements/issues/465
https://github.com/dotnet/announcements/issues/472
https://github.com/dotnet/announcements/issues/473
https://github.com/dotnet/announcements/issues/478
https://github.com/dotnet/announcements/issues/484
https://support.microsoft.com/help/5130034
https://support.microsoft.com/help/5130035
https://support.microsoft.com/help/5130036
http://www.nessus.org/u?399b6da0
Plugin Details
Severity: Critical
ID: 366548
File Name: smb_nt_ms26_oct_aspdotnet_core.nasl
Version: 1.1
Type: Local
Agent: windows
Family: Windows
Published: 10/16/2026
Updated: 10/16/2026
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.49
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:microsoft:asp.net_core
Required KB Items: SMB/Registry/Enumerated, installed_sw/ASP .NET Core Windows
Patch Publication Date: 10/13/2026
Vulnerability Publication Date: 10/13/2026
Reference Information
CVE: CVE-2026-70159, CVE-2026-70175, CVE-2026-70179, CVE-2026-70181, CVE-2026-70183, CVE-2026-70186, CVE-2026-70188, CVE-2026-70196, CVE-2026-88092, CVE-2026-92707, CVE-2026-96230, CVE-2026-96236