DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-47300: CVE-2026-47300: Elevation of Privilege in ASP.NET Core Negotiate Authentication Handler

#security #cve #cybersecurity

CVE-2026-47300: Elevation of Privilege in ASP.NET Core Negotiate Authentication Handler

Vulnerability ID: CVE-2026-47300
CVSS Score: 8.8
Published: 2026-07-14

CVE-2026-47300 is a high-severity Elevation of Privilege (EoP) vulnerability in Microsoft's ASP.NET Core framework, affecting the Negotiate Authentication Handler when configured to retrieve security groups and role mappings via an LDAP/Active Directory directory service. In cross-platform Linux and macOS environments where native Windows token group expansion is unavailable, an authenticated attacker with low-privileged network access can manipulate LDAP query structures or force connections to untrusted directory resources, resulting in unauthorized administrative role assignment.

TL;DR

An input validation flaw in ASP.NET Core's LDAP-based Negotiate authentication allows low-privileged authenticated users to escalate privileges to administrator by injecting structural characters into LDAP queries or redirecting queries to rogue directory controllers.

Technical Details

  • CWE ID: CWE-303
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Base Score: 8.8
  • EPSS Score: 0.00538 (42.03rd percentile)
  • Impact: Elevation of Privilege (EoP)
  • Exploit Status: None (No public PoCs)
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft Visual Studio 2022
  • Microsoft Visual Studio 2026
  • .NET 8.0: 8.0.0 to < 8.0.29 (Fixed in: 8.0.29)
  • .NET 9.0: 9.0.0 to < 9.0.18 (Fixed in: 9.0.18)
  • .NET 10.0: 10.0.0 to < 10.0.6 (Fixed in: 10.0.6)
  • Visual Studio 2022 (v17.12): 17.12.0 to < 17.12.22 (Fixed in: 17.12.22)
  • Visual Studio 2022 (v17.14): 17.14.0 to < 17.14.36 (Fixed in: 17.14.36)
  • Visual Studio 2026 (v18.7): 18.0 to < 18.7.4 (Fixed in: 18.7.4)

Code Analysis

Commit: 368cb51

Align ASP.NET Core internal dependencies with updated Microsoft Identity Web versions containing enhanced input sanitization and secure role-mapping principles.

Mitigation Strategies

  • Apply framework patches immediately to updated SDK/Runtime versions.
  • Disable LDAP-based group membership resolution if alternative claims mapping mechanisms exist.
  • Restrict outgoing network traffic from application hosting environments to trusted domain controllers only.

Remediation Steps:

  1. Upgrade the .NET Hosting Bundle, SDK, or Runtime on production and development hosts to 8.0.29, 9.0.18, or 10.0.6 as applicable.
  2. Recompile dependent applications to ensure the target framework resolution pulls the updated libraries.
  3. Configure network access controls to block outbound LDAP/LDAPS traffic to non-allowlisted systems.
  4. Monitor directory query logs for unexpected special character sequences in user identity queries.

References

Read the full report for CVE-2026-47300 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)