CVE-2026-70175

Awaiting Analysis Awaiting Analysis - Queue

Improper Authentication in ASP.NET Core

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Microsoft Corporation

Description

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70175

EUVD

EUVD-2026-99694

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	ASP.NET	Core 10.0 10.0
Microsoft	ASP.NET	Core 8.0 8.0
Microsoft	ASP.NET	Core 9.0 9.0
Microsoft	Microsoft	Visual Studio 2022 version 17.14 17.14.0
Microsoft	Microsoft	Visual Studio 2026 version 18.10 18.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in ASP.NET Core that allows an unauthorized attacker to gain elevated privileges over a network without needing valid credentials.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data or perform actions with higher privileges than intended, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations that mandate strict access controls and data protection.

Mitigation Strategies

Apply the latest security updates from Microsoft for ASP.NET Core versions 8.0, 9.0, or 10.0 as soon as possible to address the improper authentication issue.

Hi! I’m here to help you understand CVE-2026-70175. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70