CVE-2026-70179

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70179

Configurations

No configuration.

History

13 Oct 2026, 19:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-13 19:19

Updated : 2026-10-22 22:18

NVD link : CVE-2026-70179

Mitre link : CVE-2026-70179

CVE.ORG link : CVE-2026-70179

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-70179", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70179", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secure@microsoft.com", "affectedData": [{"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"status": "affected", "version": "17.14.0", "lessThan": "17.14.42", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2026 version 18.10", "versions": [{"status": "affected", "version": "18.10.0", "lessThan": "18.10.4", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft.AspNetCore.Authentication.Negotiate", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.13", "versionType": "custom"}], "platforms": [".NET 10.0 runtime installed on Linux", ".NET 10.0 runtime installed on Mac OS", ".NET 10.0 runtime installed on Windows", ".NET 8.0 runtime installed on Linux", ".NET 8.0 runtime installed on Mac OS", ".NET 8.0 runtime installed on Windows", ".NET 9.0 runtime installed on Linux", ".NET 9.0 runtime installed on Mac OS", ".NET 9.0 runtime installed on Windows"]}]}], "published": "2026-10-13T19:19:32.170", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70179", "source": "secure@microsoft.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network."}], "lastModified": "2026-10-22T22:18:34.377", "sourceIdentifier": "secure@microsoft.com"}