CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation
CVE-2026-40372 (TL-2026-0408), also tracked as ASP.NET Core DP Forge, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-22. It has no confirmed attribution, affects Microsoft Microsoft.AspNetCore.DataProtection, references 1 CVE (CVE-2026-40372), maps to 18 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0408
- Threat ID
- TL-2026-0408
- Also known as
- ASP.NET Core DP Forge, DotNet10 Cookie Forge, DataProtection Regression April 2026
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-04-22
- Last reviewed
- 2026-04-22
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, technology, e-commerce, manufacturing, education, telecommunications, energy, defense
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 25
Microsoft released an out-of-band emergency patch on 2026-04-22 for CVE-2026-40372, a CVSS 9.8 cryptographic regression in Microsoft.AspNetCore.DataProtection introduced with .NET 10.0.6 (April Patch Tuesday). The flaw lets unauthenticated network attackers forge authentication cookies, antiforgery tokens, and other protected payloads, leading to full authentication bypass and, on IIS application pools running as LocalSystem, SYSTEM-level remote code execution. All ASP.NET Core applications on .NET runtime 10.0.0 through 10.0.6 are affected; the fix is .NET 10.0.7.
How CVE-2026-40372 works
CVE-2026-40372 is a critical cryptographic flaw in the Microsoft.AspNetCore.DataProtection stack — the library that underpins virtually every secure-at-rest ASP.NET Core primitive, including authentication cookies, antiforgery tokens, OAuth/OpenID state tokens, TempData providers, data-protected query strings, and any consumer of IDataProtector.Protect/Unprotect. The issue was introduced as a regression in the April 2026 Patch Tuesday release of .NET 10.0.6 when Microsoft refactored the key-ring rotation logic inside KeyRingBasedDataProtector to improve cold-start performance. During that refactor, a fallback path unintentionally permitted a caller-controlled purpose string combined with a predictable HMAC subkey, allowing an attacker to craft an authenticator that the validator accepts as a legitimately signed, non-tampered payload. Independent researchers disclosed working forgery primitives to MSRC on 2026-04-18, and Microsoft shipped an OOB security update four days later on 2026-04-22.
Exploitation is unauthenticated, network-reachable, and deterministic. An attacker needs only the externally observable base64 key identifier embedded in a legitimate Set-Cookie response to fingerprint the victim key-ring version. From that, they derive a forgery oracle that can mint arbitrary claims inside .AspNetCore.Cookies, .AspNetCore.Identity.Application, or any customer-named cookie that uses the default data-protection purpose. Forged cookies decrypt cleanly on the server and are indistinguishable from legitimate authentications at the application layer — no TLS break, no XSS, no CSRF, no valid credential required.
The severity jumps from authentication bypass to SYSTEM compromise because of how ASP.NET Core applications are typically hosted: IIS in-process hosting runs application pools under the ApplicationPoolIdentity account by default, but a significant fraction of enterprise deployments explicitly elevate pools to LocalSystem for service-account DPAPI access, Kerberos constrained delegation, or legacy WebForms interop. A forged authentication cookie granting administrator role membership therefore lands the attacker directly inside a SYSTEM-privileged worker process. From there, any deserialization sink, admin-only file upload, or management endpoint (ELMAH, Hangfire, Orchard Core, Umbraco, Sitecore, custom management UIs) becomes a SYSTEM RCE primitive without a second vulnerability.
Microsoft Security Response Center rates the vulnerability 9.8 CRITICAL with CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA is expected to add CVE-2026-40372 to the Known Exploited Vulnerabilities catalog within the standard 14-day Binding Operational Directive 22-01 window given the OOB release and trivial exploit development cost. Affected packages include Microsoft.AspNetCore.DataProtection, Microsoft.AspNetCore.DataProtection.Extensions, Microsoft.AspNetCore.DataProtection.StackExchangeRedis, and Microsoft.AspNetCore.DataProtection.EntityFrameworkCore at versions 10.0.0 through 10.0.6. The Azure App Service platform began automatic runtime upgrades on 2026-04-22 17:00 UTC; self-hosted applications and containerized workloads require manual patching to .NET 10.0.7 or rotation of data-protection keys after patching.
MITRE ATT&CK techniques used in TL-2026-0408
Collection
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Persistence
T1136 Create Account; T1505 Server Software Component
lateral-movement
T1550 Use Alternate Authentication Material
Impact
Resource Development
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
Credential Access
defense-impairment
Affected products and versions in CVE-2026-40372
- Microsoft — Microsoft.AspNetCore.DataProtection
Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
Fixed in: 10.0.7 - Microsoft — Microsoft.AspNetCore.DataProtection.Extensions
Vulnerable versions: 10.0.0-10.0.6
Fixed in: 10.0.7 - Microsoft — Microsoft.AspNetCore.DataProtection.StackExchangeRedis
Vulnerable versions: 10.0.0-10.0.6
Fixed in: 10.0.7 - Microsoft — Microsoft.AspNetCore.DataProtection.EntityFrameworkCore
Vulnerable versions: 10.0.0-10.0.6
Fixed in: 10.0.7 - Microsoft — .NET Runtime
Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
Fixed in: 10.0.7 - Microsoft — .NET SDK
Vulnerable versions: 10.0.100; 10.0.101; 10.0.102; 10.0.103; 10.0.104; 10.0.105; 10.0.106
Fixed in: 10.0.107 - Microsoft — ASP.NET Core Hosting Bundle
Vulnerable versions: 10.0.0-10.0.6
Fixed in: 10.0.7 - Microsoft — Azure App Service (Windows/Linux .NET 10 stack)
Vulnerable versions: runtime 10.0.0-10.0.6
Fixed in: runtime 10.0.7 via platform auto-upgrade 2026-04-22
Remediation for CVE-2026-40372
Patches
- .NET SDK/Runtime 10.0.7 (released 2026-04-22 OOB) — includes fixed Microsoft.AspNetCore.DataProtection.dll with reverted KeyRingBasedDataProtector path.
- Azure App Service platform upgrade wave 2026.04.22 — automatic for Windows and Linux app service plans on .NET 10 runtime stack.
- Windows Hosting Bundle 10.0.7 for IIS in-process hosting.
- Official container images mcr.microsoft.com/dotnet/aspnet:10.0.7 and mcr.microsoft.com/dotnet/sdk:10.0.7.
Immediate actions
- Upgrade to .NET 10.0.7 runtime on all ASP.NET Core hosts immediately — OOB patch released 2026-04-22.
- After patching, rotate all data-protection keys by deleting the existing key-ring directory (default: %LOCALAPPDATA%\ASP.NET\DataProtection-Keys or mapped Redis/EF key store) and forcing new key generation on worker restart.
- Invalidate all outstanding authentication cookies and forcibly re-authenticate all users after key rotation — do not assume session table clearing is sufficient.
- Audit IIS application pools and Kestrel service accounts for LocalSystem or domain administrator identities and step them down to least-privilege ApplicationPoolIdentity where possible.
- Block external access to administrative endpoints (/admin, /umbraco, /sitecore, /orchard, /hangfire) at the reverse proxy until patching is verified.
Workarounds
- If patching must be delayed, pin data-protection purpose strings to per-tenant random values and enable IDataProtectionBuilder.ProtectKeysWithCertificate with a cert unreachable from the app identity — this does not eliminate the flaw but raises exploit complexity.
- Terminate TLS at a WAF and enforce request body / header inspection rules blocking oversized Set-Cookie payloads and non-browser User-Agents probing /signin, /.auth/login, and antiforgery endpoints.
- Temporarily disable persistent authentication cookies and require every request through an external identity provider (Entra ID, Okta) with JWT bearer tokens that do not use the ASP.NET Core data-protection stack.
Longer-term hardening
- Enforce .NET runtime patch-tier compliance with automated scanning of published binaries for vulnerable Microsoft.AspNetCore.DataProtection versions.
- Move data-protection key storage to a centralized store (Azure Key Vault, AWS Secrets Manager, HSM-backed store) with auditable rotation cadence of no longer than 90 days.
- Adopt short-lived authentication cookies (ExpireTimeSpan <= 8h) with sliding expiration disabled on privileged roles to limit the blast radius of any future forgery primitive.
- Instrument IDataProtector call sites with logging hooks that record purpose strings and key identifiers on every Unprotect call for post-incident forensics.
- Run ASP.NET Core worker processes under dedicated gMSA or virtual service accounts — never LocalSystem or built-in NetworkService with broad privileges.
CVEs associated with CVE-2026-40372
Weaknesses (CWE) in CVE-2026-40372
CWE-347, CWE-327, CWE-290, CWE-384, CWE-287
Timeline of CVE-2026-40372
- Microsoft ships .NET 10.0.6 as part of the April 2026 Patch Tuesday release. KeyRingBasedDataProtector refactor silently introduces the cryptographic regression that becomes CVE-2026-40372.
- Azure security telemetry flags anomalous cookie-validation success rates across multiple App Service tenants; Microsoft engineering begins internal root-cause investigation.
- Independent researchers reverse-engineer the 10.0.6 diff, identify the forgery primitive, and develop a working proof-of-concept against a test application.
- Researchers submit coordinated disclosure to Microsoft Security Response Center (MSRC). MSRC confirms the issue and begins OOB patch preparation.
- Microsoft finalizes .NET 10.0.7 runtime and SDK builds with reverted KeyRingBasedDataProtector code path; internal validation completes.
- Threadlinqs Intelligence publishes TL-2026-0408 analysis with MITRE mapping, detection content, and attack simulations for defenders.
- BleepingComputer, The Register, and major security vendors publish coverage; public exploit research begins and preliminary POC code surfaces on GitHub.
- Microsoft publishes CVE-2026-40372 advisory, releases .NET 10.0.7 OOB runtime/SDK/hosting-bundle/container images, and begins automatic Azure App Service platform upgrade.
- As of 2026-05-29, CVE-2026-40372 is fixed by the OOB .NET 10.0.7 release (2026-04-22) with Azure auto-patched, and Microsoft plus May vendor roundups report no in-the-wild exploitation; it is NOT in CISA KEV. Residual risk persists on unpatched/un-key-rotated hosts where forged cookies stay valid, and public PoC tooling exists.
Sources cited for CVE-2026-40372
- Microsoft releases emergency security updates for critical ASP.NET flaw
- Microsoft Security Advisory CVE-2026-40372
- Microsoft.AspNetCore.DataProtection on NuGet
- .NET 10.0.7 Release Notes
- Announcing .NET 10 Patch Release April 2026 (OOB)
- NVD Entry CVE-2026-40372
- ASP.NET Core Data Protection Documentation
- CISA Alert — Critical Microsoft ASP.NET Core Vulnerability
- The Register — Microsoft rushes OOB patch for critical .NET bug
- Rapid7 Analysis — CVE-2026-40372 Exploitability Breakdown
Threats related to CVE-2026-40372
Detection coverage for TL-2026-0408
As of 2026-04-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0408 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.