CVE-2026-50528

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An authorization bypass vulnerability (CVE-2026-50528) has been identified in .NET's server-side Negotiate authentication (NegotiateStream), which allows attackers to bypass a required Extended Protection (channel binding) control on non-Windows hosts and relay authenticated Negotiate/NTLM credentials to a server that believes it is protected.

Per CWE-863: Incorrect Authorization, the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

This issue affects multiple versions of .NET, including the End-of-Life .NET 6.0 line covered by NES.

‍

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.NETCore.App (the .NET shared framework / runtime pack; System.Net.Security is an in-box assembly, not an opt-in NuGet package)
• Affected versions: >= 6.0.0 <= 6.0.42
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the System.Net.Security components of the Microsoft.NETCore.App shared framework in multiple versions of .NET. On non-Windows platforms the ExtendedProtectionPolicy.OSSupportsExtendedProtection property reports that Extended Protection (channel binding) is supported even though the platform cannot genuinely enforce it. Its getter returns a hardcoded true:

// .NET Core is supported only on Win7+ where ExtendedProtection is supported.
return true;

When a server-side Negotiate authentication handler (NegotiateStream.AuthenticateAsServer) is configured with new ExtendedProtectionPolicy(PolicyEnforcement.Always, ...), it relies on this property to decide whether the required channel binding is in force. Because the property is unconditionally true, the server accepts the configuration and proceeds without ever enforcing channel binding on Unix, and no error is raised. A network attacker can then relay captured NTLM or Kerberos (Negotiate) credentials to the server, which believes it is protected by Extended Protection when it is not. HeroDevs NES for .NET 6 targets Linux, so the exploitable configuration (Extended Protection required on a non-Windows host) is directly in scope.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET Runtime >= 8.0.29
  • .NET Runtime >= 9.0.18
  • .NET Runtime >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft credits Henrique Pereira of Microsoft and Ky0toFu for reporting this vulnerability.