Microsoft Releases Emergency Updates for Critical ASP.NET Core Flaw: CVE-2026-40372

Microsoft has issued out-of-band (OOB) security updates to address CVE-2026-40372, a critical privilege escalation vulnerability affecting ASP.NET Core Data Protection cryptographic APIs. This flaw enables unauthenticated attackers to forge authentication cookies, potentially leading to SYSTEM privileges on affected devices. The swift release of these emergency patches shows the issue is severe, and organizations must implement updates quickly.

The vulnerability was identified after users reported decryption failures in their applications following the installation of the .NET 10.0.6 update. This critical flaw impacts a fundamental security component within the .NET ecosystem. Rapid remediation is essential for maintaining application integrity and user trust. Organizations relying on ASP.NET Core Data Protection should prioritize patching to prevent exploitation.

This incident shows the continuous challenges in software security, even within well-maintained platforms. Addressing such core vulnerabilities requires a proactive stance on patching and an understanding of potential attack vectors that can lead to significant compromises, including issues similar to previous .NET-related vulnerabilities such as the QNAP ASP.NET Core flaw and QNAP NetBak CVE-2025-55315.

What is CVE-2026-40372 and Why is it Critical?

CVE-2026-40372 is a critical privilege escalation vulnerability within the Microsoft.AspNetCore.DataProtection NuGet packages. This flaw allows unauthenticated attackers to forge authentication payloads, bypass security checks, and ultimately gain SYSTEM privileges on systems running vulnerable ASP.NET Core applications. The ability for unauthenticated individuals to elevate privileges to SYSTEM makes this vulnerability very dangerous, as it can grant complete control over the compromised system.

The core of the issue lies in a regression present in Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6. Specifically, the managed authenticated encryptor component incorrectly computes its HMAC validation tag. In some cases, the computed hash is discarded, leading to a broken validation routine. This defect allows malicious actors to craft forged payloads that appear legitimate to the Data Protection API, enabling them to decrypt previously protected data and create unauthorized authentication tokens.

The Data Protection API is a key component in ASP.NET Core applications, responsible for protecting sensitive data such as authentication cookies, anti-forgery tokens, TempData, and OpenID Connect (OIDC) state. A flaw in this API can undermine the security posture of an entire application, making any data protected by it susceptible to compromise. The fact that the attack does not require prior authentication increases its criticality and broadens the potential attack surface.

How Can CVE-2026-40372 Be Exploited?

Exploitation of CVE-2026-40372 uses the flawed HMAC validation within the ASP.NET Core Data Protection cryptographic APIs. An attacker can craft a malicious payload that, due to the regression, passes the authenticity checks performed by the vulnerable applications. This forged payload can then be used to decrypt previously protected information, such as user authentication cookies or session data.

Once an attacker can forge authentication cookies or decrypt sensitive payloads, they can impersonate legitimate users, including privileged ones. Microsoft's advisory states that if an attacker successfully used forged payloads to authenticate as a privileged user during the vulnerable window, they might have induced the application to issue legitimately-signed tokens to themselves. These tokens could include session refresh tokens, API keys, or password reset links. These legitimately-signed tokens remain valid even after the application has been upgraded to a patched version, unless the Data Protection key ring is rotated.

With forged credentials or decrypted data, attackers can disclose files or modify data within the application's scope. While the vulnerability does not directly impact system availability, the compromise of data integrity and confidentiality can have severe consequences for an organization. Identifying potential exploitation requires strong breach detection mechanisms and continuous monitoring of application logs and user behavior anomalies. Organizations should also consider using cyber threat intelligence platform capabilities to stay informed of potential attack patterns and indicators of compromise related to such flaws.

Impact on Organizations and Data Integrity

The impact of CVE-2026-40372 on organizations is substantial, due to its ability to grant unauthenticated privilege escalation and compromise data protected by ASP.NET Core Data Protection. For businesses, this translates to significant risks across several areas. The most immediate concern is the potential for unauthorized access to systems and sensitive data, leading to data breaches or operational disruptions. The ability to forge authentication cookies means that an attacker could bypass standard login mechanisms and impersonate any user, including administrators, without requiring their credentials.

This flaw compromises trust in web application security. Critical business applications, customer portals, and internal systems built on ASP.NET Core are exposed to this risk. Beyond direct system compromise, the vulnerability could lead to the unauthorized issuance of tokens like session refresh tokens or API keys. If these tokens are compromised, they can persist and allow an attacker continued access even after the primary vulnerability is patched, unless specific key rotation actions are taken. This persistence mechanism complicates remediation and necessitates thorough post-incident investigations.

For organizations, the compromise of data integrity and confidentiality due to file disclosure and data modification capabilities poses a direct threat to compliance and regulatory standing. The source of the vulnerability in a widely used NuGet package also shows the importance of supply-chain risk monitoring. Dependencies on third-party libraries and frameworks introduce potential weak points that necessitate careful scrutiny. Proactive measures, such as a full cyber threat intelligence platform, help anticipate and identify emerging threats. Also, the risk of forged tokens could lead to compromised accounts, making brand leak alerting and dark web monitoring service essential tools to detect if stolen credentials or access tokens appear on underground forum intelligence or telegram threat monitoring channels. The regular issuance of out-of-band updates, as seen with CVE-2026-40372 and previous critical issues like the Microsoft zero-day patch fix, indicates the dynamic nature of threats, and organizations must remain vigilant.

Mitigation and Remediation for CVE-2026-40372

To mitigate the risks associated with CVE-2026-40372, organizations must take immediate action. Microsoft has released out-of-band security updates that address the regression in the Microsoft.AspNetCore.DataProtection package. The primary remediation step involves updating the affected NuGet package to the patched version.

The recommended steps for remediation are as follows:

  • Update the Microsoft.AspNetCore.DataProtection package: Upgrade all instances of Microsoft.AspNetCore.DataProtection from versions 10.0.0 through 10.0.6 to version 10.0.7. This update rectifies the HMAC validation routine, ensuring that forged payloads are automatically rejected.
  • Redeploy applications: After updating the NuGet package, redeploy all affected ASP.NET Core applications to ensure the patched libraries are in use across the environment.
  • Rotate Data Protection key ring: If there is any suspicion that the vulnerability might have been exploited, or if any legitimately-signed tokens could have been issued to an attacker during the vulnerable window, organizations must rotate the Data Protection key ring. This action invalidates any previously issued tokens, including potentially compromised ones, preventing their continued use. More information on Data Protection key management is available in Microsoft's documentation.
  • Implement continuous monitoring: Beyond patching, organizations should maintain continuous monitoring for signs of compromise. This includes vigilant breach detection protocols, monitoring authentication logs for unusual activity, and using insights from a cyber threat intelligence platform to track potential exploitation attempts.
  • Review application security posture: Conduct regular security audits and penetration testing of ASP.NET Core applications. This practice helps identify other potential vulnerabilities and ensures that security controls are functioning as intended. Given the nature of this flaw, focusing on authentication mechanisms and cryptographic implementations is prudent.

Addressing CVE-2026-40372 swiftly is critical to preventing unauthenticated privilege escalation and protecting sensitive data. Organizations should incorporate this emergency update into their patching cycles immediately to safeguard their ASP.NET Core applications and the data they protect.

Technical Takeaways

  • CVE-2026-40372 is a critical privilege escalation vulnerability in ASP.NET Core Data Protection cryptographic APIs.
  • The flaw stems from a regression in Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6, leading to incorrect HMAC validation.
  • Exploitation allows unauthenticated attackers to forge authentication cookies, decrypt protected payloads, gain SYSTEM privileges, and disclose or modify data.
  • Resolution requires updating the Microsoft.AspNetCore.DataProtection NuGet package to 10.0.7 and redeploying affected applications.
  • If exploitation is suspected, rotating the Data Protection key ring is essential to invalidate any potentially forged or compromised tokens.