Executive brief
A security vulnerability exists in the ASP.NET Core Negotiate authentication component, which is used by web applications to handle Windows-based logins. If an application also uses LDAP to retrieve user roles, an attacker could exploit this flaw to gain higher-level permissions than they should have. This could allow an unauthorized user to access sensitive data or perform administrative actions within the affected application.
Technical details
An elevation of privilege vulnerability exists in the Microsoft.AspNetCore.Authentication.Negotiate package due to an incorrect implementation of the authentication algorithm (CWE-303). The root cause is improper validation within the Negotiate authentication handler when the application is configured to use LDAP to retrieve role information. An authenticated attacker can exploit this over the network with low complexity to elevate their privileges. The vulnerability affects .NET 8, 9, and 10. Microsoft has released patched versions (8.0.29, 9.0.18, and 10.0.10) to address this issue.
Affected products
- Microsoft Microsoft.AspNetCore.Authentication.Negotiate >= 8.0.0, <= 8.0.28; >= 9.0.0, <= 9.0.17; >= 10.0.0, <= 10.0.9
Timeline
- 2026-07-14: disclosed: Initial advisory publication
- 2026-07-14: patched: Patched versions released for .NET 8, 9, and 10
- 2026-07-21: advisory: GitHub Advisory reviewed and updated
References
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-8prm-248r-h957
- https://github.com/dotnet/announcements/issues/409
- https://github.com/dotnet/aspnetcore/discussions/67785
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300
- https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-8prm-248r-h957