[ CVE-2026-70179 · Published 13 Oct 2026 ]
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability
CVSS 7.5
EPSS <1%3 agency advisoriesFix available
[ Description ]Official description
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
[ Fixes ]Fixes and patches
- Microsoft.AspNetCore.Authentication.Negotiate 10.0.13Fixed version · GitHub Advisories · nuget package Microsoft.AspNetCore.Authentication.Negotiate: upgrade to 10.0.13 or later (affected >= 10.0.0, <= 10.0.12)
- Microsoft.AspNetCore.Authentication.Negotiate 8.0.32Fixed version · GitHub Advisories · nuget package Microsoft.AspNetCore.Authentication.Negotiate: upgrade to 8.0.32 or later (affected >= 8.0.0, <= 8.0.31)
- Microsoft.AspNetCore.Authentication.Negotiate 9.0.21Fixed version · GitHub Advisories · nuget package Microsoft.AspNetCore.Authentication.Negotiate: upgrade to 9.0.21 or later (affected >= 9.0.0, <= 9.0.20)
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1316
Multiple vulnerabilities in Microsoft products Translated from French
Multiple vulnerabilities have been discovered in Microsoft products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3893
Microsoft Entwicklerwerkzeuge: Multiple vulnerabilities Translated from German
-
NCSC-NLNCSC-2026-0426
Vulnerabilities fixed in Microsoft Developer Tools Translated from Dutch
[ Packages ]Affected open-source packages
- Microsoft.AspNetCore.Authentication.Negotiate nugetAffected >= 10.0.0, <= 10.0.12 · fixed in 10.0.13 · GHSA-vrrp-6v32-2p8g
- Microsoft.AspNetCore.Authentication.Negotiate nugetAffected >= 8.0.0, <= 8.0.31 · fixed in 8.0.32 · GHSA-vrrp-6v32-2p8g
- Microsoft.AspNetCore.Authentication.Negotiate nugetAffected >= 9.0.0, <= 9.0.20 · fixed in 9.0.21 · GHSA-vrrp-6v32-2p8g