Vulnerabilities · 145 days ago

ASP.NET Core Token Forgery Leaves Privileged Sessions Behind

The break is not just privilege escalation. A regression in ASP.NET Core DataProtection let forged payloads pass authenticity checks, so patching to 10.0.7 stops new abuse but does not revoke tokens already issued during the vulnerable window.

Microsoft says CVE-2026-40372 affects Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6, including .NET 10.0.6, and can let an unauthenticated attacker gain SYSTEM privileges on Linux, macOS, and other non-Windows systems. The flaw can also expose files and modify data, and Microsoft fixed it in ASP.NET Core 10.0.7.

The lasting risk is token persistence. If a forged login led the app to mint session refresh, API key, or password reset tokens, those tokens stay valid after upgrade unless the DataProtection key ring is rotated.

CVE-2026-40372

NVD KEV

CVSS 9.1 CRITICAL: improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate… EPSS 11% (95th percentile). Microsoft patch: 5091596.

Patch available KB5091596 Download →

Timeline

Apr 22 Reported by Ars Technica Security

Sources

4 sources covering this story

Ars Technica Security Apr 22
Microsoft issues emergency update for macOS and Linux ASP.NET threat
When authentication fails, things can go very, very wrong.
The Hacker News Apr 22
Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug
CVE-2026-40372 scores 9.1 due to cryptographic flaw in ASP.NET Core 10.0.0–10.0.6, risking SYSTEM access.
CSO Online Apr 22
Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core
Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired.
BleepingComputer Apr 22
Microsoft releases emergency patches for critical ASP.NET flaw
Microsoft has released out-of-band (OOB) security updates to patch a critical ASP.NET Core privilege escalation vulnerability.

Entities

CVE-2026-40372

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-04-23

Editions

Vulnerabilities · 145 days agoASP.NET Core Token Forgery Leaves Privileged Sessions BehindThe break is not just privilege escalation. A regression in ASP.NET Core DataProtection let forged payloads pass authenticity checks, so patching to 10.0.7 stops new abuse but does not revoke tokens already issued during the vulnerable window.Microsoft says CVE-2026-40372 affects Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6, including .NET 10.0.6, and can let an unauthenticated attacker gain SYSTEM privileges on Linux, macOS, and other non-Windows systems. The flaw can also expose files and modify data, and Microsoft fixed it in ASP.NET Core 10.0.7.The lasting risk is token persistence. If a forged login led the app to mint session refresh, API key, or password reset tokens, those tokens stay valid after upgrade unless the DataProtection key ring is rotated.

CVE-2026-40372

NVD KEV

CVSS 9.1 CRITICAL: improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate… EPSS 11% (95th percentile). Microsoft patch: 5091596.