CVE-2026-70179
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core Negotiate LDAP authentication can associate an authenticated identity with an unintended LDAP principal when the LDAP result is not verified against the Kerberos principal SID.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core Negotiate LDAP authentication can associate an authenticated identity with an unintended LDAP principal when the LDAP result
Affected
- nuget microsoft.aspnetcore.authentication.negotiateversion unspecified
Sources
- CVE.orgCVE-2026-70179
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-70179
30-day exploitation probability 0.6%
first.org - GitLab Advisory DatabaseCVE-2026-70179
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core Negotiate LDAP authentication can associate an authenticated identity with an unintended LDAP principal when the LDAP result
advisories.gitlab.com