Elevation of Privilege Vulnerability in.NET ASP.NET Core
An elevation of privilege vulnerability is reportedly present in the ASP.NET Core Negotiate authentication handler in .NET 8,.NET 9, and.NET 10, affecting Microsoft.NET projects using specific package versions.
What happened
An elevation of privilege vulnerability appears to exist in the ASP.NET Core Negotiate authentication handler in.NET 8,.NET 9, and.NET 10 due to improper parsing. This vulnerability, tracked as CVE-2026-47303 and GHSA-2P3Q-H3HG-JCQQ, affects any Microsoft.NET project using the Microsoft.AspNetCore.Authentication.Negotiate package versions >=10.0.0, <=10.0.9 for.NET 10, >=9.0.0, <=9.0.17 for.NET 9, and >=8.0.0, <=8.0.9 for.NET 8.
The vulnerability is under investigation, and it is recommended to upgrade to the patched versions: 10.0.10 for.NET 10, 9.0.18 for.NET 9, and 8.0.10 for.NET 8. For more details, consult the primary sources: [GHSA-2p3q-h3hg-jcqq](https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2p3q-h3hg-jcqq) and [GHSA-8prm-248r-h957](https://github.com/dotnet/aspnetcore/security/advisories/GHSA-8prm-248r-h957).
Professional software engineers should review their projects for use of the affected package versions and consider upgrading to the recommended versions to mitigate potential risk. Further information and confirmations should be obtained from the primary sources as the investigation continues.
How 0Day mitigates this
Microsoft.AspNetCore.Authentication.Negotiate is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.