CVE-2026-109481: Cross-Site Request Forgery Leading to Elevation of Privilege in ASP.NET Core

Vulnerability ID: CVE-2026-109481
CVSS Score: 7.5
Published: 2026-11-10

CVE-2026-109481 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in the ASP.NET Core Blazor Server and interactive component architecture. The flaw exists within the internal circuit state synchronization endpoint (/_blazor/refresh), which fails to enforce antiforgery token validation or verify cross-origin request headers. By inducing an authenticated victim to issue a cross-site request targeting a pre-allocated circuit identifier, an unauthenticated attacker can bind the victim's security principal to the attacker's active SignalR circuit, resulting in full privilege elevation within the application scope.

TL;DR

An unauthenticated attacker can hijack an authenticated user's session security context in ASP.NET Core Blazor Server applications via a Cross-Site Request Forgery flaw in the /_blazor/refresh endpoint, leading to Elevation of Privilege.

Technical Details

• Vulnerability Type: Cross-Site Request Forgery (CWE-352) to Elevation of Privilege
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
• Affected Component: ASP.NET Core Blazor Server Circuit Endpoint (/_blazor/refresh)
• Attack Vector: Network (Cross-Origin Browser Request)
• Privileges Required: None (Requires Victim User Interaction)
• Security Impact: Hijacking of authenticated ClaimsPrincipal on attacker SignalR circuit
• Exploit Status: Unproven (No public PoC or active exploitation)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft .NET 11.0 on Linux
• Microsoft .NET 11.0 on macOS
• Microsoft .NET 11.0 on Windows
• Microsoft Visual Studio 2026 on Windows
• .NET 11.0 (Linux, macOS, Windows): 11.0.0-preview.1 (< 11.0.0) (Fixed in: 11.0.0)
• Microsoft Visual Studio 2026: 18.12 (< 18.12.0) (Fixed in: 18.12.0)

Mitigation Strategies

• Upgrade .NET 11.0 runtimes and SDKs from preview builds to the stable 11.0.0 general availability release.
• Update Microsoft Visual Studio 2026 installations to version 18.12.0 or later.
• Enforce Fetch Metadata validation (Sec-Fetch-Site) on internal Blazor endpoints via custom middleware or WAF rules.
• Configure authentication session cookies with SameSite=Lax or SameSite=Strict and SecurePolicy=Always.
• Ensure ASP.NET Core Antiforgery middleware (app.UseAntiforgery()) is active across all interactive component pipelines.

Remediation Steps:

1. Inventory all servers and developer workstations to identify installations of .NET 11.0.0-preview.1 and Visual Studio 2026 version 18.12.
2. Download and install the official .NET 11.0.0 release package from Microsoft or update via package managers (apt, yum, winget).
3. Update Visual Studio 2026 to version 18.12.0 using the Visual Studio Installer.
4. Rebuild and redeploy ASP.NET Core Blazor Server applications targeting the patched .NET 11.0.0 runtime.
5. Verify in application startup code (Program.cs) that app.UseAntiforgery() is invoked and authentication cookies do not use SameSiteMode.None unless strictly required.

References

• Microsoft Security Response Center (MSRC) Security Update Guide
• Official CVE Record: CVE-2026-109481
• ASP.NET Core Official Release Tag v11.0.0
• MITRE ATT&CK Search: CVE-2026-109481
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-109481 on our website for more details including interactive diagrams and full exploit analysis.