Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

Summary: Microsoft released out-of-band updates for an ASP.NET Core vulnerability tracked as CVE-2026-40372, which carries a CVSS score of 9.1 out of 10.0 and is rated Important, crediting an anonymous researcher for the discovery. Microsoft said a regression in the Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages caused the managed authenticated encryptor to compute its HMAC validation tag over the wrong bytes and discard the hash in some cases, letting an attacker forge payloads and gain SYSTEM privileges; the flaw is fixed in ASP.NET Core version 10.0.7.
What you should know: Tokens an attacker obtained by authenticating as a privileged user during the vulnerable window remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated, so patching alone leaves that access in place.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-40372
Related: ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026