Key points
- The flaw affects Microsoft.AspNetCore.Authentication.Negotiate packages for .NET 8, 9, and 10.
- Patches are available in versions 8.0.32, 9.0.21, and 10.0.13.
- The vulnerability enables privilege escalation when LDAP claim resolution is enabled.
Microsoft has released patches for CVE-2026-70179, a high-severity elevation of privilege vulnerability in ASP.NET Core. The flaw allows an attacker who already has some level of authorization to bypass authentication checks by spoofing LDAP results. This enables the attacker to associate their identity with an unintended LDAP principal, effectively gaining elevated privileges over the network. The issue stems from a failure to verify LDAP results against the Kerberos principal SID during the Negotiate authentication process.
According to the GitHub advisory GHSA-vrrp-6v32-2p8g, the vulnerability impacts applications using specific versions of the Microsoft.AspNetCore.Authentication.Negotiate NuGet package. Developers running .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, or .NET 10.0.0 through 10.0.12 are exposed. The flaw is rated with a CVSS score of 7.5, indicating high severity. It affects Windows, Linux, and macOS systems, but only when LDAP claim resolution is explicitly enabled within the application configuration.
What we know
The Microsoft Security Update Guide classifies this as an authentication bypass by spoofing, aligning with CWE-290. The vulnerability exists because the authentication module does not properly cross-reference the LDAP outcome with the Kerberos principal security identifier. This mismatch allows an authorized user to manipulate the identity association. The attack requires network access and low initial privileges, but does not require user interaction. The impact includes high confidentiality, integrity, and availability consequences, as the attacker gains unauthorized elevated access.
Defender's checklist
- Verify if your projects reference Microsoft.AspNetCore.Authentication.Negotiate packages.
- Check current version numbers against the affected ranges for .NET 8, 9, and 10.
- Confirm whether LDAP claim resolution is enabled in your application settings.
- Review deployment pipelines to ensure patched versions are integrated before production.
What analysts watch for
Security teams typically monitor for unusual privilege escalations following successful authentication events. Analysts examine logs for discrepancies between the authenticated user identity and the associated LDAP principal. They look for patterns where authorized users access resources beyond their normal permission scope. Teams also assess whether LDAP claim resolution is enabled, as this feature introduces the specific attack surface. Reviewing Kerberos ticket validation logs helps identify spoofing attempts. Monitoring for unexpected changes in user roles or access rights provides early warning of exploitation.
What to do and how to stay safe: Microsoft
- Audit all ASP.NET Core projects for the Microsoft.AspNetCore.Authentication.Negotiate package.
- Update affected packages to version 8.0.32, 9.0.21, or 10.0.13 as applicable.
- Disable LDAP claim resolution if it is not strictly required for your application.
- Monitor authentication logs for anomalies once the vendor provides an update.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-70179?
The vulnerability affects .NET 8.0.0 to 8.0.31, .NET 9.0.0 to 9.0.20, and .NET 10.0.0 to 10.0.12.
Is this vulnerability critical or high severity?
It is rated high severity with a CVSS score of 7.5.
Does this affect all operating systems?
It affects Windows, Linux, and macOS, but only when LDAP claim resolution is enabled.
