The security flaw (tracked as CVE-2026-40372) was found in the ASP.NET Core Data Protection cryptographic APIs, and it could allow unauthenticated attackers to gain SYSTEM privileges on affected devices by forging authentication cookies. Microsoft discovered the flaw following user reports that decryption was failing in their applications after installing the .NET 10.0.6 update release during this month's Patch Tuesday. A regression in the Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages causes the managed authenticated encryptor to compute its HMAC validation tag over the wrong bytes of the payload and then discard the computed hash in some cases. In these cases, the broken validation could allow an attacker to forge payloads that pass DataProtection's authenticity checks, and to decrypt previously-protected payloads in auth cookies, antiforgery tokens, TempData, OIDC state, etc. If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens (session refresh, API key, password reset link, etc.) to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated. This vulnerability can also enable attackers to disclose files and modify data, but they cannot impact the system's availability.
| Vendor | Product | Versions |
|---|---|---|
| microsoft | asp.net core | 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| microsoft | asp.net | cert_advisory | 90% |
Updated severity from CRITICAL to HIGH and added 'important' tag.
Updated description with detailed technical information about the vulnerability and added CVE-2026-40372 to tags.
Updated description with technical details, added affected versions, included new CWE, and added MITRE ATT&CK technique T1071.001.
Updated affected versions to include 10.0.6, changed severity to HIGH, and noted no patch available.
Added a detailed description of the vulnerability and marked it as actively exploited with an exploit available.
Initial creation
