EUVD-2026-99696
GHSA-vrrp-6v32-2p8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged network user
-
DeliveryTrigger Negotiate LDAP claim resolution
-
ExploitSpoof LDAP result to unintended principal
-
ExecutionSID not verified against Kerberos
-
PersistSession bound to higher-privileged identity
-
ImpactElevated privileges in application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the application use the Microsoft.AspNetCore.Authentication.Negotiate package (affected: 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12) WITH LDAP claim resolution enabled - the vendor states the flaw occurs because the LDAP result is not verified against the Kerberos principal SID, allowing an authenticated identity to be associated with an unintended LDAP principal. Per the CVSS vector the attacker must be authenticated (PR:L) and reach the app over the network (AV:N) with no user interaction (UI:N). Key limiting factors: LDAP claim resolution is an opt-in, non-default feature (so most ASP.NET Core deployments are not exposed), the attacker needs valid prior access, and AC:H indicates a specific spoofing/timing condition beyond the attacker's full control must be met. Applies on Windows, Linux, and macOS only when LDAP claim resolution is enabled. |
| Impact | This is a genuine but conditional, moderately-prioritized issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) scores 7.5 High and credits full technical impact (C:H/I:H/A:H), which aligns with the SSVC 'Technical Impact: total' rating and matches the authentication-bypass-by-spoofing (CWE-290) nature of the flaw - a successful attacker can be associated with an unintended, potentially higher-privileged LDAP principal. However, several signals pull the real-world risk down: AC:H reflects that exploitation depends on a specific non-default feature (LDAP claim resolution) and on winning a spoofing condition, PR:L confirms the attacker must already be an authenticated/authorized network user, and the SSVC framework rates Exploitation as 'none' and Automatable as 'no.' No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of in-the-wild activity. The signals are internally consistent (vendor-authored CVSS, SSVC, and description all point to a config-dependent, authenticated, hard-to-automate elevation of privilege). Net: patch promptly where the Negotiate + LDAP claim resolution feature is in use, but this is not a drop-everything internet-wide threat. |
| Exploit ScenarioDerived | In an enterprise intranet ASP.NET Core app using the Negotiate handler with LDAP claim resolution enabled, an already-authenticated low-privileged user manipulates/spoofs the LDAP lookup so their session is bound to a different, higher-privileged LDAP principal because the LDAP result is never validated against the Kerberos principal's SID, yielding privilege elevation. No public exploit identified at time of analysis, and the high attack complexity (AC:H) means the attacker must satisfy a specific spoofing/timing condition against a non-default configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
RemediationAI
Vendor-released patch: update the Microsoft.AspNetCore.Authentication.Negotiate package reference to 8.0.32, 9.0.21, or 10.0.13 depending on the major line in use, install the corresponding latest .NET SDK/runtime (Visual Studio 2022 17.14.42 or later, or Visual Studio 2026 18.10.4 or later, will pull the updated SDKs), and restart the affected applications so the new assemblies load; self-contained deployments must be republished rather than relying on a runtime update. Verify current versions with 'dotnet --info' and the package reference list before and after the change, using the guidance in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70179), GHSA-vrrp-6v32-2p8g (https://github.com/dotnet/aspnetcore/security/advisories/GHSA-vrrp-6v32-2p8g), and the .NET announcement (https://github.com/dotnet/announcements/issues/458); HeroDevs also tracks the issue at https://www.herodevs.com/vulnerability-directory/cve-2026-70179. If immediate patching is impossible, the most direct compensating control is to disable LDAP claim resolution in the Negotiate handler's configuration, which removes the vulnerable code path entirely - the trade-off is that group or attribute claims sourced from LDAP stop being populated, so any authorization logic depending on those claims will need an alternative source (for example, Kerberos group SIDs or a separate directory lookup) or will fail closed. Additional measures with limited but real value include restricting network reachability of the affected endpoints to known-authenticated client subnets, and monitoring for anomalous LDAP principal-to-authentication mappings, though neither addresses the underlying missing SID verification and should be treated only as temporary risk reduction until the patched package is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Microsoft.AspNetCore.Authentication.Negotiate, the ASP.NET Core authentication handler that performs Windows Negotiate (Kerberos/NTLM) authentication and can optionally enrich the resulting ClaimsPrincipal by resolving additional attributes from an LDAP directory. Per Microsoft's advisory, when the LDAP query result is not validated against the Security Identifier (SID) of the Kerberos principal that actually authenticated, the handler can bind an authenticated identity to an unintended LDAP principal - the classic CWE-290 (Authentication Bypass by Spoofing) pattern in which an identity assertion from one source is accepted without a cryptographic or identifier-based binding to the credential that produced it. Because the package is a NuGet library rather than a platform component, the vulnerable code ships inside applications built against the affected versions and runs cross-platform (Windows, Linux, macOS), including self-contained deployments that do not pick up updated shared runtimes automatically. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable, authenticated, no-user-interaction attack with a pre-existing condition (the unverified LDAP-to-Kerberos binding) that the attacker cannot fully engineer, and the EUVD build listings for Visual Studio 2022 17.14.x and Visual Studio 2026 18.10.x reflect that the bundled .NET SDKs and runtime packs are the principal distribution channel for the affected library.
Know when Asp Net Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated network user (PR:L, AV:N) must win a spoofing condition against the opt-in LDAP claim resolution feature (AC:H); binding to a higher-privileged principal yields total impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Technical POC Analysis
CWE-290, authentication bypass by spoofing, in the NuGet package Microsoft.AspNetCore.Authentication.Negotiate.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity authentication bypass in Microsoft's ASP.NET Core Negotiate authentication package can cause an authenticated user's Kerberos identity to be associated with an unintended LDAP directory principal, effectively letting one signed-in user operate with another account's privileges across affected applications. Exposure is limited to applications running specific package versions (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12) that have also enabled LDAP claim resolution, a non-default, opt-in setting, so the blast radius is narrower than the CVSS score alone suggests. Leadership should care because a successful exploit yields high confidentiality, integrity, and availability impact within the affected application's data and workflows, yet the required misconfiguration and lack of observed exploitation make this a planned remediation item rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Asp Net Core
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and den
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a s
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP r
Cross-site scripting (CWE-79) in the ASP.NET Core Blazor WebAssembly Server hosting component allows an unauthenticated,
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and e
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retri
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disru
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memor
Exploit-DB