Microsoft fixes ASP.NET Core email auth flaw in versions 8, 9, and 10

Microsoft has released security updates for ASP.NET Core to address a high-severity elevation of privilege vulnerability. The flaw, tracked as CVE-2026-70175, affects identity management components in versions 8, 9, and 10.

What happened

Microsoft Security Update Guide describes CVE-2026-70175 as an improper authentication issue in ASP.NET Core that allows unauthorized network attackers to elevate privileges. The GitHub advisory GHSA-x3vp-85cm-q97r provides further technical detail on the affected components.

The vulnerability exists within Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI packages. According to the advisory, password-reset and confirmation flows can send mail to an unvalidated request address rather than the user's stored canonical address. This behavior bypasses intended validation controls.

Microsoft has issued patched versions for all supported branches. For ASP.NET Core 8, the fix is in version 8.0.32. For version 9, the patch is 9.0.21. For version 10, the updated package is 10.0.13. These updates cover all supported platforms, including Windows, Linux, and macOS, and all architectures.

Why it matters

The CVSS score for this flaw is 8.1, which Microsoft classifies as high severity. The vector indicates network-based attack access with high complexity and no user interaction required. That suggests the flaw could be exploited by remote adversaries who can intercept or manipulate identity-related requests.

This issue follows a recent patch for a Kestrel HTTP smuggling flaw in ASP.NET Core 8-11, as Patch Gazette reported on October 13, 2026. The recurrence of high-severity issues in the framework underscores the need for rigorous update management in web application stacks.

What to watch

• Monitor internal logs for unusual password-reset or account-confirmation email activity.
• Verify that application configurations enforce canonical address validation for identity flows.
• Check for any custom identity implementations that might bypass standard library controls.
• Review access logs for signs of privilege escalation attempts following failed authentication events.

Who needs to act first

Teams usually prioritize systems exposed to the public internet, as they face the highest risk of remote exploitation. Check whether critical customer-facing applications use the affected identity packages. Roll out fixes to these external endpoints first, after validating stability in a test environment. Back up configurations before applying updates. For internal tools, schedule updates promptly but allow more time for regression testing. Reduce exposure by limiting network access to identity endpoints while patches are prepared.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Audit all applications using Microsoft.AspNetCore.Identity to identify vulnerable package versions.
• Update NuGet packages to the patched versions listed in the advisory (8.0.32, 9.0.21, 10.0.13).
• Restart application services to ensure the new runtime libraries are loaded correctly.
• Verify that password-reset emails are sent only to validated user addresses after patching.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ASP.NET Core versions are affected by CVE-2026-70175?

Versions 8, 9, and 10 of ASP.NET Core are affected across Windows, Linux, and macOS platforms.

Is there a fix available for this vulnerability?

Yes, Microsoft has released patched versions 8.0.32, 9.0.21, and 10.0.13 for the respective branches.

What is the root cause of this privilege escalation flaw?

The flaw arises from password-reset flows sending mail to unvalidated request addresses instead of stored canonical addresses.