Full Report
Microsoft has released out-of-band (OOB) security updates to patch a critical ASP.NET Core privilege escalation vulnerability. [...]
Analysis Summary
# Vulnerability: ASP.NET Core Data Protection Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-40372
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-353: Missing Support for Integrity Check (Regression-based Cryptographic Failure)
## Affected Systems
- **Products:** ASP.NET Core applications utilizing Data Protection APIs.
- **Versions:** `Microsoft.AspNetCore.DataProtection` NuGet packages versions 10.0.0 through 10.0.6.
- **Configurations:** Applications using the managed authenticated encryptor for authentication cookies, anti-forgery tokens, TempData, or OIDC state.
## Vulnerability Description
A cryptographic regression was introduced in the managed authenticated encryptor within the ASP.NET Core Data Protection stack. The flaw causes the system to compute HMAC validation tags over incorrect payload bytes and, in certain scenarios, discard the computed hash entirely during validation. This failure allows an unauthenticated attacker to bypass authenticity checks by forging payloads. Specifically, attackers can forge authentication cookies or decrypt previously protected payloads (such as API keys or session state) to escalate privileges to the SYSTEM level.
## Exploitation
- **Status:** Not explicitly reported as exploited in the wild, but prompted by user reports of decryption failures (functional regression).
- **Complexity:** Low (Automated forging of payloads is possible due to the lack of proper validation).
- **Attack Vector:** Network (Unauthenticated remote access via HTTP/HTTPS).
## Impact
- **Confidentiality:** High (Ability to decrypt protected payloads, OIDC state, and session tokens).
- **Integrity:** High (Ability to forge authentication cookies and modify application data).
- **Availability:** None (Vendor reports that this flaw does not impact system availability).
## Remediation
### Patches
- Update the **Microsoft.AspNetCore.DataProtection** NuGet package to version **10.0.7** or higher.
- Deploy the updated application to ensure the corrected validation routine is active.
### Workarounds
- **Key Rotation:** Microsoft recommends rotating the Data Protection key ring after updating to version 10.0.7. This is necessary because any legitimately-signed tokens (session refreshes, password reset links) issued to an attacker during the "vulnerable window" will remain valid even after the patch is applied.
## Detection
- **Indicators of Compromise:** Monitor logs for unexpected decryption failures or cryptographic exceptions originating from `Microsoft.AspNetCore.DataProtection`.
- **Detection Methods:** Audit issued authentication tokens and session logs for anomalies during the window of time between the installation of .NET 10.0.0-10.0.6 and the 10.0.7 patch.
## References
- Microsoft Security Advisory: hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-40372
- .NET 10.0.7 Release Notes: hxxps[://]github[.]com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.7.md
- Official Announcement: hxxps[://]github[.]com/dotnet/announcements/issues/395
- Developer Blog: hxxps[://]devblogs[.]microsoft[.]com/dotnet/dotnet-10-0-7-oob-security-update/