Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug
Microsoft has pushed an out-of-band update to remediate a serious weakness in ASP.NET Core that could be abused to elevate privileges. The flaw, cataloged as CVE-2026-40372, carries a CVSS score of 9.1/10 and is classified as CRITICAL. An anonymous researcher has been credited with reporting the issue.
In its advisory, Microsoft described the problem as a failure to correctly validate a cryptographic signature in ASP.NET Core that could allow an unauthorized actor, communicating over a network, to gain elevated rights. If exploited, the company warns, an attacker might obtain SYSTEM-level privileges on affected hosts.
Microsoft noted that an attacker exploiting this bug could read and alter files and data, but successful exploitation depends on three specific conditions being met:
- The application pulls in the Microsoft.AspNetCore.DataProtection 10.0.6 package from NuGet, either directly or via a dependency such as Microsoft.AspNetCore.DataProtection.StackExchangeRedis.
- The NuGet-supplied copy of that library is actually loaded at runtime by the application.
- The application is running on a non-Windows operating system, for example Linux or macOS.
The tech giant fixed the vulnerability in ASP.NET Core version 10.0.7. According to Microsoft’s release notes, a regression introduced in the Microsoft.AspNetCore.DataProtection NuGet packages from 10.0.0 through 10.0.6 caused the managed authenticated encryptor to calculate its HMAC validation tag over incorrect portions of the payload and, in certain situations, to discard the computed hash altogether.
Because of this flawed validation, attackers could craft forged payloads that appear to pass DataProtection’s authenticity checks. The weakness also made it possible to decrypt previously protected items, including authentication cookies and anti-forgery tokens, among others.
Microsoft cautioned that if an attacker used forged payloads to impersonate a privileged account while the application was vulnerable, the application might have issued legitimately signed tokens (for example, session refresh tokens, API keys, password reset links, etc.) to the attacker. Those tokens do not automatically become invalid after upgrading to 10.0.7; they remain usable until the DataProtection key ring is rotated.
Administrators are advised to update affected applications to ASP.NET Core 10.0.7 as soon as possible and to rotate the DataProtection key ring to invalidate any tokens that may have been created during the vulnerable period.