An ASP.NET Core vulnerability has prompted Microsoft to release an emergency patch Tuesday for a high-severity cybersecurity flaw that allows unauthenticated attackers to gain SYSTEM privileges on macOS and Linux devices. The vulnerability, tracked as CVE-2026-40372, affects versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package, a component of the web development framework.
The Technical Flaw
The vulnerability stems from faulty verification of cryptographic signatures within the ASP.NET Core vulnerability framework. It exploits a regression bug discovered during the development of version 10.0.6. The managed authenticated encryptor computes its HMAC validation tag over incorrect payload bytes, then discards the computed hash. This flaw allows unauthenticated people to forge authentication payloads during the HMAC validation process, bypassing security checks that verify data integrity between clients and servers.
Microsoft assigned a severity rating of 9.1 out of 10 to CVE-2026-40372. The company stated that attackers could forge credentials to authenticate as privileged users and gain full compromise of the underlying machine. Notably, even after patching, devices remain at risk if the forged credentials are not purged from the system.
Post-Patch Remediation Required
Microsoft emphasized that updating to version 10.0.7 is only the first step in remediation. The company stated in its advisory: “If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.”
Affected users must rotate the DataProtection key ring if their applications served Internet-exposed endpoints while running a vulnerable version. Additionally, users should audit application-level long-lived artifacts created during the vulnerable period, as these items survive key rotation and must be rotated at the application layer.
Which Systems Are Affected
The vulnerability primarily impacts macOS and Linux systems running ASP.NET Core applications. Windows devices are not affected because DataProtection on Windows uses encryptors that do not contain the bug. The majority of affected users ran version 10.0.6 that was loaded at runtime on non-Windows operating systems, particularly when applications either do not target Microsoft.NET.Sdk.Web or include a Microsoft.AspNetCore.App framework reference with the default PrunePackageReference setting enabled.
A smaller group of users face vulnerability when their non-Windows applications or libraries used any vulnerable version of Microsoft.AspNetCore.DataProtection and the build consumed the net462 or netstandard2.0 target framework asset of the affected package.
Recommended Action
Microsoft advised users to update the Microsoft.AspNetCore.DataProtection package to version 10.0.7 immediately. The software update addresses both the decryption regression and the underlying security vulnerability. Organizations using ASP.NET Core for web development should prioritize this patch deployment across their infrastructure, particularly for applications exposed to the internet or handling sensitive data.
“If your application uses ASP.NET Core Data Protection, update the Microsoft.AspNetCore.DataProtection package to 10.0.7 as soon as possible to address the decryption regression and security vulnerability.”
Microsoft Security Advisory
ASP.NET Core is Microsoft’s open-source web development framework designed for writing .NET applications that run on Windows, macOS, Linux, and Docker containers. The framework emphasizes performance and stability, allowing runtime components, APIs, compilers, and languages to evolve while maintaining platform support for running applications. This vulnerability discovery underscores the importance of rapid security patching in cybersecurity management for organizations relying on modern development frameworks.
Source: Ars Technica
