Microsoft.AspNetCore.Authentication.Negotiate Elevation of Privilege Vulnerability

Microsoft has disclosed a high-severity elevation of privilege vulnerability (CVE-2026-70179) impacting the Microsoft.AspNetCore.Authentication.Negotiate package within .NET applications. The flaw manifests when LDAP claim resolution is enabled, as the library fails to properly verify the LDAP result against the Kerberos principal SID during authentication. This failure allows a user or attacker to gain the identity context of an unintended LDAP principal, potentially leading to unauthorized access to application resources and functions. The vulnerability affects .NET deployments on Windows, Linux, and macOS platforms. Successful exploitation requires an attacker to already possess a level of authenticated access within the environment, from which they can then elevate privileges to target sensitive LDAP principals. Defenders should prioritize updating the vulnerable package versions in all .NET projects to the patched releases (10.0.13, 8.0.32, or 9.0.21) and ensuring all affected self-contained applications are recompiled and redeployed.

Impact

The vulnerability carries a CVSS score of 7.5 and affects any .NET enterprise application utilizing Negotiate LDAP authentication with claim resolution enabled. If exploited, an attacker can bypass intended security boundaries by assuming the identity of other LDAP principals, leading to unauthorized data access, administrative actions, or lateral movement within the application context. The impact is significant for applications that rely on LDAP identity resolution to manage sensitive user roles and access controls.

Recommendation

• Identify all .NET projects in the environment using the Microsoft.AspNetCore.Authentication.Negotiate package via the dotnet --info command or by auditing project files.
• Upgrade the Microsoft.AspNetCore.Authentication.Negotiate package to the patched versions: 10.0.13, 8.0.32, or 9.0.21.
• Recompile and redeploy all self-contained applications utilizing the affected versions to ensure the security fix is embedded in the application runtime.
• Review authentication logs and LDAP access patterns for unusual identity claims that do not align with the established Kerberos principal SID for the associated user sessions.