CVE-2026-47300: 
C# vulnerability analysis and mitigation

CVE-2026-47300 is an Elevation of Privilege vulnerability in the ASP.NET Core Negotiate Authentication handler, caused by an incorrect implementation of an authentication algorithm (CWE-303). It affects the Microsoft.AspNetCore.Authentication.Negotiate NuGet package across .NET 8.0 (< 8.0.29), .NET 9.0 (< 9.0.18), and .NET 10.0 (< 10.0.10), as well as Visual Studio 2022 (versions 17.12.x < 17.12.22 and 17.14.x < 17.14.36) and Visual Studio 2026 (18.7.x < 18.7.4). The vulnerability was disclosed on July 14, 2026, as part of Microsoft's July 2026 Patch Tuesday. It carries a CVSS v3.1 base score of 8.8 (High) (MSRC Advisory, GitHub Advisory).

The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm), specifically within the ASP.NET Core Negotiate authentication handler. The flaw exists when an application uses Negotiate authentication combined with LDAP to retrieve role information — a configuration that is required for exploitation. An authenticated attacker with low privileges can exploit the improper validation over the network without any user interaction to elevate their privileges. The vulnerability is associated with CAPEC-90 (Reflection Attack in Authentication Protocol), suggesting the flaw may involve improper handling of authentication tokens or role claims during the Negotiate/Kerberos/NTLM exchange (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated low-privileged attacker to elevate their privileges to a higher level over the network, with high impact to confidentiality, integrity, and availability of the affected system. An attacker who gains elevated privileges could access sensitive data, modify application behavior, or disrupt service availability. The scope is limited to the affected component, but the privilege escalation could enable further lateral movement within the environment (GitHub Advisory, MSRC Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The SSVC assessment from NVD indicates exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.527% (42nd percentile), reflecting a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already be authenticated with low privileges and the target application must be configured to use Negotiate authentication with LDAP role retrieval (GitHub Advisory).

Microsoft has released patched versions addressing this vulnerability. Developers should update to the following: .NET 8.0.29 or later, .NET 9.0.18 or later, .NET 10.0.10 or later, Visual Studio 2022 17.12.22 or 17.14.36 or later, and Visual Studio 2026 18.7.4 or later. Applications using self-contained deployments targeting affected versions must be recompiled and redeployed. As a configuration-based mitigation, applications are only affected if they use Negotiate authentication and LDAP to retrieve role information — disabling LDAP-based role retrieval in Negotiate authentication removes the attack surface. After updating the runtime or SDK, restart all affected applications for changes to take effect (GitHub Advisory, MSRC Advisory, Red Hat Errata).

The vulnerability was covered as part of Microsoft's July 2026 Patch Tuesday, which addressed a record 570 vulnerabilities. Security outlets including BleepingComputer and Rapid7 included it in their Patch Tuesday roundups, noting its high CVSS score and privilege escalation nature. Ubuntu, Red Hat, Fedora, and Oracle Linux all issued their own advisories and errata packages addressing the vulnerability in their .NET runtime packages shortly after Microsoft's disclosure (BleepingComputer, Rapid7, Red Hat Bugzilla).