ASP.NET Core: Privilege escalation via wrong LDAP principal in Negotiate handler

Summary

The Negotiate authentication handler (Microsoft.AspNetCore.Authentication.Negotiate) in ASP.NET Core can attach role claims from the wrong directory account to an authenticated user. This happens when LDAP claim resolution is enabled and the LDAP result is not verified against the Kerberos principal SID. An attacker with a valid low-privilege account on the target can thereby gain the roles of another account; the CVSS score is 7.5 (High), but the attack complexity is high.

Affected

• Microsoft.AspNetCore.Authentication.Negotiate 10.0.0 to below 10.0.13 (official CVE record)
• Only apps with the Negotiate scheme and LDAP claim resolution enabled (EnableLdap) are affected, according to the advisory details summarised by HeroDevs
• Secondary sources also list 8.0.0 to 8.0.31 and 9.0.0 to 9.0.20, which are not in the official CVE record: unverified
• .NET 6: HeroDevs lists 6.0.0 to 6.0.46, Microsoft does not list it: unverified
• Visual Studio 2022 17.14.0 to below 17.14.42 and Visual Studio 2026 18.10.0 to below 18.10.4 (official CVE record)

Fixed in

• Microsoft.AspNetCore.Authentication.Negotiate 10.0.13 (official CVE record)
• Secondary sources: 8.0.32 and 9.0.21, unverified against Microsoft's advisory
• Visual Studio 17.14.42 and 18.10.4 (listed by the official CVE record; the exact build numbers are not verified by a second source)
• Linux distributions have published fixes (for example Ubuntu, Red Hat, Amazon Linux, AlmaLinux)
• The fix is in the NuGet package, not the shared framework: a runtime update alone does not fix an application

Workaround

• Patching is the fix. Microsoft's advisory describes no workaround in the sources reviewed.
• Check whether LDAP claim resolution (EnableLdap) is enabled. Applications without it are not affected according to HeroDevs. Disabling it is a configuration change that should be confirmed with the vendor's guidance.
• A third-party aggregator suggests disabling the Negotiate scheme or enforcing certificate-based authentication. This is not from Microsoft and must be verified before use.

Exploitation

• CISA KEV: not listed
• EPSS: below 1%
• CISA SSVC: exploitation none, automatable no, technical impact total
• No public proof of concept found in the research. The advisory credits a single researcher.

Our recommendation

• Inventory .NET applications that use Microsoft.AspNetCore.Authentication.Negotiate and check whether LDAP claim resolution is enabled.
• Update the NuGet package to 10.0.13 or later (and to the fixed versions for 8.0 and 9.0 once confirmed by Microsoft), then redeploy the application. A runtime update alone is not sufficient.
• Identify any .NET 6 applications and plan a supported upgrade, since .NET 6 is out of support.
• Update Visual Studio on developer machines and build servers, and apply Linux distribution package updates.
• Check whether any internet-facing application uses Negotiate. The main risk is an insider or a compromised low-privilege account reaching an internal application.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70179 msrc.microsoft.com
• GitHub Advisory GHSA-vrrp-6v32-2p8g github.com
• dotnet/announcements issue 458 github.com
• HeroDevs vulnerability directory: CVE-2026-70179 www.herodevs.com
• Ubuntu security: CVE-2026-70179 ubuntu.com
• Red Hat Bugzilla 2548790 bugzilla.redhat.com
• OpenCVE: CVE-2026-70179 app.opencve.io
• Vulners: CVE-2026-70179 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:58.