Microsoft Issues Emergency Patch for ASP.NET Core Vulnerability

Microsoft has released an emergency update to address a critical security vulnerability in its ASP.NET Core framework, tracked as CVE-2026-40372. This flaw, which affects versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package, allows unauthenticated attackers to gain SYSTEM privileges on devices running Linux or macOS applications. The vulnerability arises from improper verification of cryptographic signatures, enabling attackers to forge authentication payloads during the HMAC validation process.

Ars TechnicaMicrosoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

The vulnerability has been assigned a CVSS score of 9.1 out of 10, indicating its high severity. Microsoft explained that the flaw could allow unauthorized users to elevate their privileges over a network, potentially leading to unauthorized file disclosures and data modifications. Successful exploitation requires that the application utilizes the vulnerable version of the DataProtection package, is loaded at runtime, and operates on a non-Windows operating system.

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation BugArs Technica

Microsoft's advisory noted that the issue stems from a regression in the affected NuGet packages, which caused the managed authenticated encryptor to compute its HMAC validation tag incorrectly. This miscalculation could allow attackers to forge payloads that pass authenticity checks and decrypt previously protected payloads, including authentication cookies and antiforgery tokens.

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

Even after the release of the patch in version 10.0.7, devices may remain compromised if authentication credentials created by an attacker are not purged. Microsoft warned that if an attacker exploited the vulnerability during the window of exposure, they could have induced the application to issue legitimately signed tokens, such as session refresh links or API keys, which would remain valid post-update unless the DataProtection key ring is rotated.

Ars TechnicaMicrosoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

In its advisory, Microsoft emphasized the importance of updating to version 10.0.7 to mitigate the risk associated with this vulnerability. The company stated, “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” highlighting the potential severity of the issue.

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

While Microsoft has taken steps to address the vulnerability, some security experts have raised concerns about the implications of such flaws in widely-used frameworks. The reliance on third-party packages and the potential for similar vulnerabilities to arise in the future have been points of discussion among cybersecurity professionals.

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

• “Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network,” — Microsoft Advisory

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

• “Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.” — Microsoft Advisory

Ars Technica

Following the emergency patch, organizations using ASP.NET Core are advised to review their security protocols and ensure that all affected systems are updated promptly. Additionally, they should consider rotating their DataProtection key rings to eliminate any potential risks from previously issued tokens.

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug