Microsoft released patches for a high-severity race condition in ASP.NET Core that lets attackers bypass authorization checks and elevate privileges.
Key points
- CVE-2026-70183 allows remote privilege escalation via a race condition in Blazor.
- Affected versions include ASP.NET Core 8, 9, 10 and early 11 previews.
- Patches are available for Windows, Linux and macOS runtime packages.
Microsoft has released security updates for ASP.NET Core to address a vulnerability that allows attackers to bypass authorization controls. The flaw, tracked as CVE-2026-70183, stems from improper synchronization in how the framework handles concurrent requests.
What happened
According to Microsoft, a race condition in the `Microsoft.AspNetCore.Components.Authorization` component allows an authorized attacker to elevate privileges over a network. The issue occurs when a stale asynchronous authorization result is applied after navigation or an authorization-state change. This bypasses the current `[Authorize]` decision logic in Blazor applications.
The vulnerability affects ASP.NET Core versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1. It impacts runtime packages for Windows, Linux and macOS across all architectures. Microsoft rates the severity as high with a CVSS score of 7.5.
Why it matters
Teams usually verify that their application servers are running the latest approved versions of their web frameworks. Check whether your deployment pipelines automatically pull the newest runtime packages or if they pin specific versions. Ensure that your monitoring tools alert when critical security advisories are published for your stack.
Why it matters
Race conditions happen when multiple processes access shared data simultaneously without proper coordination. In web applications, this can lead to unpredictable behavior, such as skipping security checks. Understanding these concepts helps non-specialists grasp why timing issues in code can compromise access controls.
The fix
- Update ASP.NET Core 8.0.x to version 8.0.32.
- Update ASP.NET Core 9.0.x to version 9.0.21.
- Update ASP.NET Core 10.0.x to version 10.0.13.
- Update ASP.NET Core 11.0.x to version 11.0.0-rc.2.
What to do and how to stay safe: ASP.NET Core
- Check your application’s current ASP.NET Core version against the affected ranges listed in the advisory.
- Review your deployment logs to confirm that the patched runtime packages have been successfully installed.
- Monitor network traffic for unusual authorization attempts or privilege escalation signs while updating.
- Once the vendor provides an update for any unpatched preview versions, apply it immediately to test environments.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-70183?
It is a high-severity elevation of privilege vulnerability in ASP.NET Core caused by a race condition in Blazor authorization.
Which versions are affected?
Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are vulnerable.
Is there a patch available?
Yes, Microsoft has released patched versions 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2 for all affected platforms.
