CVE-2021-26701

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

.NET Core Remote Code Execution Vulnerability

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
Microsoft.NET Core 2.1>= 2.1, < publication
Microsoft.NET Core 3.1>= 3.1, < publication
Microsoft.NET 5.0>= 5.0.0, < publication
MicrosoftMicrosoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)>= 16.0, < publication
MicrosoftMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)>= 15.9.0, < publication
MicrosoftMicrosoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)>= 16.0.0, < publication
MicrosoftVisual Studio 2019 for Mac>= 8.0.0, < publication
MicrosoftMicrosoft Visual Studio 2019 version 16.8 (includes 16.0 - 16.7)>= 16.0, < publication
MicrosoftMicrosoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)>= 15.0.0, < publication
MicrosoftPowerShell Core 7.1>= 7.1.0, < publication
MicrosoftPowerShell Core 7.0>= 7.0.0, < publication

References

Timeline

Published
Feb 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-267026.1EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.CVE-2021-267039.8EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted JSON/XML input to a cgi/ajax/phrase CVE-2021-267048.8EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI.CVE-2021-267059.1An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without aCVE-2021-267069.8An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for CVE-2021-267079.8The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to iCVE-2021-267087.0A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are CVE-2021-267099.8D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers toCVE-2021-267106.1A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript vCVE-2021-267115.3A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a fraCVE-2021-267127.5Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a rCVE-2021-267136.5A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certi
CVE-2021-26701: High severity, CVSS 8.1 | Vulnix