CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation — Threadlinqs Intelligence
As of 2026-05-30, CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0408 · Severity: CRITICAL · CVSS: 9.8 · Status: PATCHED · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
Microsoft released an out-of-band emergency patch on 2026-04-22 for CVE-2026-40372, a CVSS 9.8 cryptographic regression in Microsoft.AspNetCore.DataProtection introduced with .NET 10.0.6 (April Patch
CVE-2026-40372 is a critical cryptographic flaw in the Microsoft.AspNetCore.DataProtection stack — the library that underpins virtually every secure-at-rest ASP.NET Core primitive, including authentication cookies, antiforgery tokens, OAuth/OpenID state tokens, TempData providers, data-protected query strings, and any consumer of IDataProtector.Protect/Unprotect. The issue was introduced as a regression in the April 2026 Patch Tuesday release of .NET 10.0.6 when Microsoft refactored the key-ring rotation logic inside KeyRingBasedDataProtector to improve cold-start performance. During that refactor, a fallback path unintentionally permitted a caller-controlled purpose string combined with a predictable HMAC subkey, allowing an attacker to craft an authenticator that the validator accepts as a legitimately signed, non-tampered payload. Independent researchers disclosed working forgery primitives to MSRC on 2026-04-18, and Microsoft shipped an OOB security update four days later on 2026-04-22.
Exploitation is unauthenticated, network-reachable, and deterministic. An attacker needs only the externally observable base64 key identifier embedded in a legitimate Set-Cookie response to fingerprint the victim key-ring version. From that, they derive a forgery oracle that can mint arbitrary claims inside .AspNetCore.Cookies, .AspNetCore.Identity.Application, or any customer-named cookie that uses the default data-protection purpose. Forged cookies decrypt cleanly on the server and are indistinguishable from legitimate authentications at the application layer — no TLS break, no XSS, no CSRF, no valid credential required.
The severity jumps from authentication bypass to SYSTEM compromise because of how ASP.NET Core applications are typically hosted: IIS in-process hosting runs application pools under the ApplicationPoolIdentity account by default, but a significant fraction of enterprise deployments explicitly elevate pools to LocalSystem for service-account DPAPI access, Kerberos constrained delegation, or legacy WebForms interop. A forged authentication cookie granting administrator role membership therefore lands the attacker directly inside a SYSTEM-privileged worker process. From there, any deserialization sink, admin-only file upload, or management endpoint (ELMAH, Hangfire, Orchard Core, Umbraco, Sitecore, custom management UIs) becomes a SYSTEM RCE primitive without a second vulnerability.
Microsoft Security Response Center rates the vulnerability 9.8 CRITICAL with CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA is expected to add CVE-2026-40372 to the Known Exploited Vulnerabilities catalog within the standard 14-day Binding Operational Directive 22-01 window given the OOB release and trivial exploit development cost. Affected packages include Microsoft.AspNetCore.DataProtection, Microsoft.AspNetCore.DataProtection.Extensions, Microsoft.AspNetCore.DataProtection.StackExchangeRedis, and Microsoft.AspNetCore.DataProtection.EntityFrameworkCore at versions 10.0.0 through 10.0.6. The Azure App Service platform began automatic runtime upgrades on 2026-04-22 17:00 UTC; self-hosted applications and containerized workloads require manual patching to .NET 10.0.7 or rotation of data-protection keys after patching.
Weaknesses (CWE)
CWE-347, CWE-327, CWE-290, CWE-384, CWE-287
Target sectors: government, financial, healthcare, technology, e-commerce, manufacturing, education, telecommunications, energy, defense
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-40372, T1595, T1592, T1587, T1190, T1078, T1059, T1059, T1505, T1136, T1068