BaselineWatch
Desk

CVE-2026-88092

9.4 critical SSVC exploitation: none Analyzed

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Fix

Microsoft's update · Important

  • Release Notes — Microsoft Visual Studio 2026 version 18.10 · build 18.10.4 · restart required
  • Release Notes — Microsoft Visual Studio 2022 version 17.14 · build 17.14.42 · restart required
  • KB5130034 — ASP.NET Core 8.0 · build 8.0.32
  • KB5130036 — ASP.NET Core 10.0 · build 10.0.13
  • Release Notes — ASP.NET Core 11.0 · build 11.0.0-rc.2
  • KB5130035 — ASP.NET Core 9.0 · build 9.0.21

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.

Patch, vendor advisory and mitigation references on NVD 1

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 3

  1. Cpes+4 CPE criteria (now 4)NVD modified 2026-10-16 15:47
  2. StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-16 15:47
  3. First seenCVSS 9.4NVD modified 2026-10-14 04:18

Affected (CPE criteria) 4

  • cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:asp.net_core:11.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*

References 1