CVE-2021-26701

.NET Core Remote Code Execution Vulnerability

HIGH

8.1

CVSS Score

Published: February 25, 2021 at 11:02 PM UTC

Updated: June 17, 2026 at 03:43 AM UTC

6 products affected across 2 vendorsFedora.netVisual Studio 2019

Using .NET Core 2.1 by Microsoft?

Get instant alerts when new vulnerabilities affect .NET Core 2.1 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 30%

SSVC

No known exploit

Description

.NET Core Remote Code Execution Vulnerability

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora · Fedora Projectrpm

95%

32 33 34

.net · Microsoft

95%

5.0 ≤ v < 5.0.45.0.0 ≤ v < publication5.0.0

Affected range stops below 5.0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below publication, so it looks safe — our inference, not a vendor statement

.NET Core · Microsoft

95%

2.1 ≤ v < 2.1.282.1 ≤ v < publication3.1 ≤ v < 3.1.153.1 ≤ v < publication2.1 3.1

Affected range stops below 2.1.28, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.1.15, so it looks safe — our inference, not a vendor statement

Affected range stops below publication, so it looks safe — our inference, not a vendor statement

PowerShell Core · Microsoft

95%

7.0.0 ≤ v < publication7.1.0 ≤ v < publication7.0 7.0.0 7.1 7.1.0

Affected range stops below publication, so it looks safe — our inference, not a vendor statement

Visual Studio 2019 · Microsoft

95%

15.0.0 ≤ v < publication16.0 ≤ v ≤ 16.916.0 ≤ v < publication16.0.0 ≤ v < publication8.0.0 ≤ v < publication15.0.0 16.0 16.0.0 16.8 16.9 8.0.0

Affected range stops below publication, so it looks safe — our inference, not a vendor statement

Visual Studio 2017 · Microsoft

60%

15.9.0 ≤ v < publication15.9.0

Affected range stops below publication, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references