Microsoft.AspNetCore.App.Runtime.linux-arm Fixes High-Severity Bug CVE-2026-70175
A high-severity advisory for the nuget package Microsoft.AspNetCore.App.Runtime.linux-arm is fixed in version 9.0.21.
Key points
- Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) has a high flaw.
- Tracked as CVE-2026-70175.
- Version 9.0.21.
Maintainers of Microsoft.AspNetCore.App.Runtime.linux-arm, a package in the nuget ecosystem, have published a high-severity security advisory (CVE-2026-70175): Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability.
At a glance
- Advisory
- GHSA-x3vp-85cm-q97r
- CVE
- CVE-2026-70175
- Package
- Microsoft.AspNetCore.App.Runtime.linux-arm (nuget)
- Severity
- High
- Patched in
- 9.0.21
What is the issue?
The GitHub-reviewed advisory explains: Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core Identity password-reset and confirmation flows can send mail to the unvalidated request address instead of the user's stored canonical address. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/457 CVSS Details - Version: 3.1 - Severity: High - Score: 8.1 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability a
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
The advisory lists a CVSS score of 8.1.
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: CVE-2026-70175
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-70175?
CVE-2026-70175 is a security vulnerability in Microsoft.AspNetCore.App.Runtime.linux-arm (nuget).
Which version fixes CVE-2026-70175?
The fix is in version 9.0.21.
