CVE‑2026‑40372 — ASP.NET Core Elevation of Privilege Vulnerability
.png)
CVE‑2026‑40372 — ASP.NET Core Elevation of
Privilege Vulnerability
Summary
CVE‑2026‑40372 is a critical elevation‑of‑privilege (EoP) vulnerability in ASP.NET Core’s Data Protection subsystem that allows unauthenticated attackers to forge authentication material and gain SYSTEM‑level or administrative privileges under specific conditions. The issue was disclosed and patched by Microsoft via an out‑of‑band update in April 2026, highlighting its severity and exploit potential.
Severity & Classification
- CVSS v3.1 Score: 9.1 (Critical / Important)
- CWE: CWE‑347 – Improper Verification of Cryptographic Signature
- Attack Vector: Network (no authentication required)
- Impact: Authentication bypass, token forgery, privilege escalation
Affected Components
The vulnerability exists in the following packages and versions:
| Component | Affected Versions | Fixed Version |
|---|---|---|
Microsoft.AspNetCore.DataProtection | 10.0.0 – 10.0.6 | 10.0.7 |
When Are You Vulnerable?
You are affected if all of the following apply:
- Your application references Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6 (directly or transitively)
- The NuGet package version is actually loaded at runtime
- The application runs on Linux, macOS, or other non‑Windows platforms
- OR the project consumes the netstandard2.0 / net462 assets from the affected package
Windows deployments using platform‑native cryptography are generally not affected.
Root Cause (What Went Wrong)
A regression in the managed authenticated encryptor caused ASP.NET Core to:
- Compute the HMAC over incorrect payload bytes
- In some cases discard the computed hash
- Improperly accept forged or tampered payloads as valid
As a result, attackers can craft authentication cookies or antiforgery tokens that pass integrity checks without possessing secret keys.
Exploitation Impact
If successfully exploited, attackers can:
- Forge authentication cookies
- Bypass antiforgery protections
- Impersonate privileged users
- Cause the app to issue legitimately signed tokens (API keys, refresh tokens, password reset links)
- Retain access even after patching, unless keys are rotated
Microsoft explicitly warns that forged tokens remain valid post‑upgrade without additional remediation.
Patch & Mitigation (Mandatory)
✅ Immediate Actions
- Upgrade to
Microsoft.AspNetCore.DataProtection 10.0.7 - Rebuild & redeploy all affected applications
- Rotate the Data Protection key ring
- Invalidate existing auth sessions and tokens
Why Key Rotation Matters
Without key rotation, any forged tokens created during the vulnerable window remain trusted, negating the patch’s effectiveness. [github.com]
Detection & Audit Recommendations
- Review logs for authentication anomalies during the vulnerable period
- Audit issued tokens (refresh tokens, JWTs, reset links)
- Identify unexpected elevation events
- Verify runtime‑loaded assemblies (NuGet vs framework reference)
Enterprise Risk Perspective
This vulnerability is particularly dangerous because it:
- Breaks a core trust boundary (authentication integrity)
- Requires no credentials to exploit
- Hits framework‑level cryptography, affecting many apps simultaneously
- Remains exploitable after patching without key rotation
Microsoft’s use of an out‑of‑band release strongly indicates a high exploitation risk window. [bleepingcomputer.com], [cambridgea...lytica.org]
References
- Microsoft Security Advisory (dotnet/announcements) [github.com]
- BleepingComputer coverage (Apr 22, 2026) [bleepingcomputer.com]
- Ars Technica analysis (Apr 22, 2026) [arstechnica.com]
If you’d like, I can:
- Help you validate whether a specific app is affected
- Provide a key‑rotation playbook
- Map this CVE to MITRE ATT&CK
- Draft a C‑level or change‑management advisory
.png)
.png)