Is CVE-2026-70179 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70179 being exploited in the wild.

How severe is CVE-2026-70179?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Microsoft ASP.NET Core Authentication.Negotiate 10.0.0 through 10.0.12, 8.0.0 through 8.0.31, 9.0.0 through 9.0.20; Microsoft.AspNetCore.Authentication.Negotiate (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.

How is CVE-2026-70179 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70179?

Check whether you run Microsoft ASP.NET Core Authentication.Negotiate or Microsoft.AspNetCore.Authentication.Negotiate (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70179: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Q: Is there a fix for CVE-2026-70179?

Yes. Microsoft.AspNetCore.Authentication.Negotiate (NuGet): upgrade to 10.0.13 or later. Until then: Update the Microsoft.AspNetCore.Authentication.Negotiate package to the patched versions (10.0.13, 8.0.32, or 9.0.21) and restart affected applications. Self-contained applications targeting the vulnerable versions must be recompiled and redeployed with the updated package. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-70179 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-70179?

Check whether you run Microsoft ASP.NET Core Authentication.Negotiate or Microsoft.AspNetCore.Authentication.Negotiate (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70179 · Severity: high · CVSS 7.5 · Published 2026-10-13

ASP.NET Core's Negotiate authentication handler in applications using LDAP claim resolution can authenticate users with incorrect permissions and access rights. An authenticated attacker on the network can associate themselves with an unintended LDAP principal, gaining unauthorized access to resources protected by identity checks. This affects web applications across Windows, Linux, and macOS deployments.

Technologies: Microsoft.AspNetCore.Authentication.Negotiate (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-70179 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70179 being exploited in the wild.
How severe is CVE-2026-70179?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Microsoft ASP.NET Core Authentication.Negotiate 10.0.0 through 10.0.12, 8.0.0 through 8.0.31, 9.0.0 through 9.0.20; Microsoft.AspNetCore.Authentication.Negotiate (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.
Is there a fix for CVE-2026-70179?: Yes. Microsoft.AspNetCore.Authentication.Negotiate (NuGet): upgrade to 10.0.13 or later. Until then: Update the Microsoft.AspNetCore.Authentication.Negotiate package to the patched versions (10.0.13, 8.0.32, or 9.0.21) and restart affected applications. Self-contained applications targeting the vulnerable versions must be recompiled and redeployed with the updated package. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70179 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70179?: Check whether you run Microsoft ASP.NET Core Authentication.Negotiate or Microsoft.AspNetCore.Authentication.Negotiate (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.Authentication.Negotiate (NuGet): upgrade to 10.0.13 or later

dotnet add package Microsoft.AspNetCore.Authentication.Negotiate --version 10.0.13

Update the Microsoft.AspNetCore.Authentication.Negotiate package to the patched versions (10.0.13, 8.0.32, or 9.0.21) and restart affected applications. Self-contained applications targeting the vulnerable versions must be recompiled and redeployed with the updated package.

Technical details

The vulnerability exists in Microsoft.AspNetCore.Authentication.Negotiate when LDAP claim resolution is enabled: the module fails to verify LDAP results against the Kerberos principal SID, allowing an attacker to associate an authenticated identity with an unintended LDAP principal (CWE-290). An authenticated attacker on the network can exploit this to escalate privileges or impersonate another principal without user interaction. Patches are available for all affected versions.

Affected products

Microsoft ASP.NET Core Authentication.Negotiate 10.0.0 through 10.0.12, 8.0.0 through 8.0.31, 9.0.0 through 9.0.20

Identifiers

CVE-2026-70179
GHSA-vrrp-6v32-2p8g

Timeline

2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.