CVE-2026-70179 is an authentication bypass vulnerability in ASP.NET Core classified as CWE-290. It permits an attacker who can spoof authentication requests to bypass access controls and elevate privileges within a networked application. The consequence is that an unauthorized user could gain higher-level permissions, enabling the potential for further lateral movement and data compromise.

The vulnerable products are Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, and the Microsoft.AspNetCore.Authentication.Negotiate component. Any installations lacking the documented Microsoft security update remain exposed.

The CVSS score of 7.5 highlights a high severity, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the flaw involves spoofing network authentication exchanges; a network attacker could craft forged requests to trigger the privilege escalation. Consequently, systems exposing the affected authentication components to untrusted environments face a notable risk.