{"uuid": "df8e1725-7fa0-4fff-8bc9-211340ec1463", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-47300", "type": "seen", "source": "https://gist.github.com/alon710/89bf510277070903ffa845b8929ac197", "content": "# CVE-2026-47300: CVE-2026-47300: Elevation of Privilege in ASP.NET Core Negotiate Authentication Handler\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-47300\n\n## Summary\nCVE-2026-47300 is a high-severity Elevation of Privilege (EoP) vulnerability in Microsoft's ASP.NET Core framework, affecting the Negotiate Authentication Handler when configured to retrieve security groups and role mappings via an LDAP/Active Directory directory service. In cross-platform Linux and macOS environments where native Windows token group expansion is unavailable, an authenticated attacker with low-privileged network access can manipulate LDAP query structures or force connections to untrusted directory resources, resulting in unauthorized administrative role assignment.\n\n## TL;DR\nAn input validation flaw in ASP.NET Core's LDAP-based Negotiate authentication allows low-privileged authenticated users to escalate privileges to administrator by injecting structural characters into LDAP queries or redirecting queries to rogue directory controllers.\n\n## Technical Details\n\n- **CWE ID**: CWE-303\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Base Score**: 8.8\n- **EPSS Score**: 0.00538 (42.03rd percentile)\n- **Impact**: Elevation of Privilege (EoP)\n- **Exploit Status**: None (No public PoCs)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 8.0\n- Microsoft .NET 9.0\n- Microsoft .NET 10.0\n- Microsoft Visual Studio 2022\n- Microsoft Visual Studio 2026\n- **.NET 8.0**: 8.0.0 to < 8.0.29 (Fixed in: `8.0.29`)\n- **.NET 9.0**: 9.0.0 to < 9.0.18 (Fixed in: `9.0.18`)\n- **.NET 10.0**: 10.0.0 to < 10.0.6 (Fixed in: `10.0.6`)\n- **Visual Studio 2022 (v17.12)**: 17.12.0 to < 17.12.22 (Fixed in: `17.12.22`)\n- **Visual Studio 2022 (v17.14)**: 17.14.0 to < 17.14.36 (Fixed in: `17.14.36`)\n- **Visual Studio 2026 (v18.7)**: 18.0 to < 18.7.4 (Fixed in: `18.7.4`)\n\n## Mitigation\n\n- Apply framework patches immediately to updated SDK/Runtime versions.\n- Disable LDAP-based group membership resolution if alternative claims mapping mechanisms exist.\n- Restrict outgoing network traffic from application hosting environments to trusted domain controllers only.\n\n**Remediation Steps:**\n1. Upgrade the .NET Hosting Bundle, SDK, or Runtime on production and development hosts to 8.0.29, 9.0.18, or 10.0.6 as applicable.\n2. Recompile dependent applications to ensure the target framework resolution pulls the updated libraries.\n3. Configure network access controls to block outbound LDAP/LDAPS traffic to non-allowlisted systems.\n4. Monitor directory query logs for unexpected special character sequences in user identity queries.\n\n## References\n\n- [Microsoft Update Guide: CVE-2026-47300](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-47300)\n- [Wiz Vulnerability Database Listing](https://www.wiz.io/vulnerability-database/cve/cve-2026-47300)\n- [ASP.NET Core Repository](https://github.com/dotnet/aspnetcore)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-47300) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-22T16:31:38.270686Z"}