CVE-2026-40372
CVSS 9.1 CRITICAL: improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate… EPSS 11% (95th percentile). Microsoft patch: 5091596.
Patch available KB5091596 Download →
Vulnerabilities & Exploits
The break is not just privilege escalation. A regression in ASP.NET Core DataProtection let forged payloads pass authenticity checks, so patching to 10.0.7 stops new abuse but does not revoke tokens already issued during the vulnerable window.
Microsoft says CVE-2026-40372 affects Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6, including .NET 10.0.6, and can let an unauthenticated attacker gain SYSTEM privileges on Linux, macOS, and other non-Windows systems. The flaw can also expose files and modify data, and Microsoft fixed it in ASP.NET Core 10.0.7.
The lasting risk is token persistence. If a forged login led the app to mint session refresh, API key, or password reset tokens, those tokens stay valid after upgrade unless the DataProtection key ring is rotated.
4 sources · Apr 22
CVSS 9.1 CRITICAL: improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate… EPSS 11% (95th percentile). Microsoft patch: 5091596.
Patch available KB5091596 Download →
Ars Technica Security
Microsoft issues emergency update for macOS and Linux ASP.NET threat
When authentication fails, things can go very, very wrong.
originalThe Hacker News
Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug
CVE-2026-40372 scores 9.1 due to cryptographic flaw in ASP.NET Core 10.0.0–10.0.6, risking SYSTEM access.
originalCSO Online
Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core
Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired.
originalPart of the PlainSec briefing for 2026-04-23
Every edition of this story: ASP.NET Core Token Forgery Leaves Privileged Sessions Behind