CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation

Key facts for ASP.NET Core cookie forgery

Detection coverage for ASP.NET Core cookie forgery

As of 2026-04-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0408 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ASP.NET Core Forged Data-Protection Cookie Accepted Without Preceding Sign-In (CVE-2026-40372) — Exploitation

Detects the primary exploitation signature for CVE-2026-40372: an ASP.NET Core authentication cookie (.AspNetCore.Cookies / .AspNetCore.Identity.Application) is presented and accepted at a protected endpoint, but no preceding interactive sign-in event exists for the same session/user in the identity audit log within a rolling 10-minute window. This correlation gap is the canonical indicator of a forged data-protection cookie.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1606.001, T1190, T1550.004
• Data sources: iis, nginx, aspnetcore_identity, azure_signinlogs, webserver_access_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype IN ("iis:access","ms:iis:default","nginx:plus:access","nginx:plus:kv") (cs_Cookie="*.AspNetCore.Cookies=*" OR cs_Cookie="*.AspNetCore.Identity.Application=*" OR cookie="*.AspNetCore.Cookies=*" OR cookie="*.AspNetCore.Identity.Application=*") cs_uri_stem IN ("/admin/*","/Identity/Account/Manage*","/umbraco/*","/sitecore/*","/orchard/*","/hangfire/*","/elmah.axd") sc_status IN (200,302)
| rex field=cs_Cookie "\.AspNetCore\.(?:Cookies|Identity\.Application)=(?<cookie_val>CfDJ8[A-Za-z0-9_\-]+)"
| eval session_key=coalesce(cookie_val,"unknown"), client_ip=coalesce(c_ip,src_ip)
| join type=left session_key [
    search index=identity sourcetype IN ("aspnetcore:identity","ms:aspnet:auth","aspnetcore:signin") event_type IN ("SignIn","LoginSuccess","Authentication") earliest=-10m@m
    | rex field=_raw "cookie_id=(?<session_key>CfDJ8[A-Za-z0-9_\-]+)"
    | stats max(_time) as signin_time by session_key
  ]
| where isnull(signin_time)
| stats count as forged_hits, values(cs_uri_stem) as endpoints, values(client_ip) as src_ips, min(_time) as first_seen, max(_time) as last_seen by session_key
| where forged_hits >= 1
| eval severity="critical", cve="CVE-2026-40372"
| table first_seen last_seen session_key src_ips endpoints forged_hits severity cve

Microsoft KQL

// CVE-2026-40372 — Forged ASP.NET Core auth cookie accepted without preceding sign-in
let window = 10m;
let cookie_hits = W3CIISLog
| where TimeGenerated > ago(24h)
| where csCookie has_any (".AspNetCore.Cookies=", ".AspNetCore.Identity.Application=")
| where csUriStem has_any ("/admin/", "/Identity/Account/Manage", "/umbraco/", "/sitecore/", "/orchard/", "/hangfire/", "/elmah.axd")
| where scStatus in (200, 302)
| extend cookie_val = extract(@"\.AspNetCore\.(?:Cookies|Identity\.Application)=(CfDJ8[A-Za-z0-9_\-]+)", 1, csCookie)
| where isnotempty(cookie_val)
| project CookieHitTime = TimeGenerated, cookie_val, cIp, csUriStem, Computer;
let signin_events = SigninLogs
| where TimeGenerated > ago(24h + window)
| where ResultType == 0
| extend cookie_val = tostring(parse_json(tostring(AuthenticationDetails))[0].CookieId)
| where isnotempty(cookie_val)
| project SigninTime = TimeGenerated, cookie_val;
cookie_hits
| join kind=leftouter (signin_events) on cookie_val
| where isnull(SigninTime) or datetime_diff('minute', CookieHitTime, SigninTime) > 10
| summarize forged_hits = count(), endpoints = make_set(csUriStem), src_ips = make_set(cIp), first_seen = min(CookieHitTime), last_seen = max(CookieHitTime) by cookie_val, Computer
| where forged_hits >= 1
| extend severity = "Critical", cve = "CVE-2026-40372"
| project first_seen, last_seen, cookie_val, src_ips, endpoints, forged_hits, Computer, severity, cve

Sigma

title: ASP.NET Core Forged Data-Protection Cookie Accepted Without Preceding Sign-In (CVE-2026-40372)
id: 3f9a2c48-40d7-4b21-9f77-1c2e4a5b7f01
status: experimental
description: Detects the primary exploitation signature for CVE-2026-40372 — an ASP.NET Core authentication cookie accepted at a protected admin endpoint with no corresponding interactive sign-in within the correlation window, indicating a forged data-protection cookie.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40372
    - https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/22
tags:
    - attack.credential_access
    - attack.initial_access
    - attack.t1606.001
    - attack.t1190
    - attack.t1550.004
    - cve.2026.40372
logsource:
    category: webserver
detection:
    selection_cookie:
        cs-Cookie|contains:
            - '.AspNetCore.Cookies='
            - '.AspNetCore.Identity.Application='
    selection_endpoint:
        cs-uri-stem|contains:
            - '/admin/'
            - '/Identity/Account/Manage'
            - '/umbraco/'
            - '/sitecore/'
            - '/orchard/'
            - '/hangfire/'
            - '/elmah.axd'
    selection_status:
        sc-status:
            - 200
            - 302
    filter_signin_correlated:
        SigninEventCorrelated: true
    condition: selection_cookie and selection_endpoint and selection_status and not filter_signin_correlated
falsepositives:
    - Legitimate long-lived persistent cookies where the corresponding sign-in event has rolled out of the correlation window
    - Internal API clients that carry session cookies without a user sign-in flow
level: critical

Known false positives:

• Legitimate persistent-cookie flows where the preceding sign-in has aged past the 10-minute correlation window
• Internal service-to-service calls that reuse session cookies without interactive authentication

Tuning notes: Adjust the correlation window (default 10 minutes) to match your session lifetime. Whitelist internal health-check IPs and known service principals. Verify your identity log sink (Azure SigninLogs, on-prem Identity audit) exposes a correlatable cookie_id / session_id field; if not, correlate on (user, client_ip) tuples as a fallback.

• 🔒 ASP.NET Core DataProtection Unprotect-Without-Protect Purpose-String Anomaly (CVE-2026-40372) — Exploitation · unlock with TL Creds
• 🔒 Direct Admin-Endpoint Access Without Login-Flow Hit — ASP.NET Core (CVE-2026-40372) — Exploitation · unlock with TL Creds
• 🔒 IIS w3wp.exe Spawning Interactive Shell After Admin-Endpoint Hit (CVE-2026-40372) — Post-Exploitation · unlock with TL Creds
• 🔒 Unusual Read Access to ASP.NET Core DataProtection Key-Ring Storage (CVE-2026-40372) — Post-Exploitation · unlock with TL Creds
• 🔒 Vulnerable Microsoft.AspNetCore.DataProtection Assembly Loaded or Present (CVE-2026-40372) — Post-Exploitation / Exposure · unlock with TL Creds
• 🔒 Forged-Cookie Session Reuse Across Divergent Source IPs (CVE-2026-40372) — C2 / Lateral Movement · unlock with TL Creds
• 🔒 Admin-Role Privileged Action From Never-Before-Seen Source IP (CVE-2026-40372) — C2 / Lateral Movement · unlock with TL Creds
• 🔒 Outbound C2 Beacon From Web Worker After Admin-Role Authentication (CVE-2026-40372) — C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise for ASP.NET Core cookie forgery

As of 2026-04-22, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-0408.

How ASP.NET Core cookie forgery works

All ASP.NET Core applications on .NET runtime 10.0.0 through 10.0.6 are affected; the fix is .NET 10.0.7.

CVE-2026-40372 is a critical cryptographic flaw in the Microsoft.AspNetCore.DataProtection stack — the library that underpins virtually every secure-at-rest ASP.NET Core primitive, including authentication cookies, antiforgery tokens, OAuth/OpenID state tokens, TempData providers, data-protected query strings, and any consumer of IDataProtector.Protect/Unprotect. The issue was introduced as a regression in the April 2026 Patch Tuesday release of .NET 10.0.6 when Microsoft refactored the key-ring rotation logic inside KeyRingBasedDataProtector to improve cold-start performance. During that refactor, a fallback path unintentionally permitted a caller-controlled purpose string combined with a predictable HMAC subkey, allowing an attacker to craft an authenticator that the validator accepts as a legitimately signed, non-tampered payload. Independent researchers disclosed working forgery primitives to MSRC on 2026-04-18, and Microsoft shipped an OOB security update four days later on 2026-04-22.

Exploitation is unauthenticated, network-reachable, and deterministic. An attacker needs only the externally observable base64 key identifier embedded in a legitimate Set-Cookie response to fingerprint the victim key-ring version. From that, they derive a forgery oracle that can mint arbitrary claims inside .AspNetCore.Cookies, .AspNetCore.Identity.Application, or any customer-named cookie that uses the default data-protection purpose. Forged cookies decrypt cleanly on the server and are indistinguishable from legitimate authentications at the application layer — no TLS break, no XSS, no CSRF, no valid credential required.

The severity jumps from authentication bypass to SYSTEM compromise because of how ASP.NET Core applications are typically hosted: IIS in-process hosting runs application pools under the ApplicationPoolIdentity account by default, but a significant fraction of enterprise deployments explicitly elevate pools to LocalSystem for service-account DPAPI access, Kerberos constrained delegation, or legacy WebForms interop. A forged authentication cookie granting administrator role membership therefore lands the attacker directly inside a SYSTEM-privileged worker process. From there, any deserialization sink, admin-only file upload, or management endpoint (ELMAH, Hangfire, Orchard Core, Umbraco, Sitecore, custom management UIs) becomes a SYSTEM RCE primitive without a second vulnerability.

Microsoft Security Response Center rates the vulnerability 9.8 CRITICAL with CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA is expected to add CVE-2026-40372 to the Known Exploited Vulnerabilities catalog within the standard 14-day Binding Operational Directive 22-01 window given the OOB release and trivial exploit development cost. Affected packages include Microsoft.AspNetCore.DataProtection, Microsoft.AspNetCore.DataProtection.Extensions, Microsoft.AspNetCore.DataProtection.StackExchangeRedis, and Microsoft.AspNetCore.DataProtection.EntityFrameworkCore at versions 10.0.0 through 10.0.6. The Azure App Service platform began automatic runtime upgrades on 2026-04-22 17:00 UTC; self-hosted applications and containerized workloads require manual patching to .NET 10.0.7 or rotation of data-protection keys after patching.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Persistence

T1136 Create Account; T1505 Server Software Component

lateral-movement

T1550 Use Alternate Authentication Material

Impact

T1565 Data Manipulation

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Credential Access

T1606 Forge Web Credentials

defense-impairment

T1685 Disable or Modify Tools

Remediation for ASP.NET Core cookie forgery

Patches

• .NET SDK/Runtime 10.0.7 (released 2026-04-22 OOB) — includes fixed Microsoft.AspNetCore.DataProtection.dll with reverted KeyRingBasedDataProtector path.
• Azure App Service platform upgrade wave 2026.04.22 — automatic for Windows and Linux app service plans on .NET 10 runtime stack.
• Windows Hosting Bundle 10.0.7 for IIS in-process hosting.
• Official container images mcr.microsoft.com/dotnet/aspnet:10.0.7 and mcr.microsoft.com/dotnet/sdk:10.0.7.

Immediate actions

• Upgrade to .NET 10.0.7 runtime on all ASP.NET Core hosts immediately — OOB patch released 2026-04-22.
• After patching, rotate all data-protection keys by deleting the existing key-ring directory (default: %LOCALAPPDATA%\ASP.NET\DataProtection-Keys or mapped Redis/EF key store) and forcing new key generation on worker restart.
• Invalidate all outstanding authentication cookies and forcibly re-authenticate all users after key rotation — do not assume session table clearing is sufficient.
• Audit IIS application pools and Kestrel service accounts for LocalSystem or domain administrator identities and step them down to least-privilege ApplicationPoolIdentity where possible.
• Block external access to administrative endpoints (/admin, /umbraco, /sitecore, /orchard, /hangfire) at the reverse proxy until patching is verified.

Workarounds

• If patching must be delayed, pin data-protection purpose strings to per-tenant random values and enable IDataProtectionBuilder.ProtectKeysWithCertificate with a cert unreachable from the app identity — this does not eliminate the flaw but raises exploit complexity.
• Terminate TLS at a WAF and enforce request body / header inspection rules blocking oversized Set-Cookie payloads and non-browser User-Agents probing /signin, /.auth/login, and antiforgery endpoints.
• Temporarily disable persistent authentication cookies and require every request through an external identity provider (Entra ID, Okta) with JWT bearer tokens that do not use the ASP.NET Core data-protection stack.

Longer-term hardening

• Enforce .NET runtime patch-tier compliance with automated scanning of published binaries for vulnerable Microsoft.AspNetCore.DataProtection versions.
• Move data-protection key storage to a centralized store (Azure Key Vault, AWS Secrets Manager, HSM-backed store) with auditable rotation cadence of no longer than 90 days.
• Adopt short-lived authentication cookies (ExpireTimeSpan <= 8h) with sliding expiration disabled on privileged roles to limit the blast radius of any future forgery primitive.
• Instrument IDataProtector call sites with logging hooks that record purpose strings and key identifiers on every Unprotect call for post-incident forensics.
• Run ASP.NET Core worker processes under dedicated gMSA or virtual service accounts — never LocalSystem or built-in NetworkService with broad privileges.

Affected and fixed versions

• Microsoft — Microsoft.AspNetCore.DataProtection
  Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
  Fixed in: 10.0.7
• Microsoft — Microsoft.AspNetCore.DataProtection.Extensions
  Vulnerable versions: 10.0.0-10.0.6
  Fixed in: 10.0.7
• Microsoft — Microsoft.AspNetCore.DataProtection.StackExchangeRedis
  Vulnerable versions: 10.0.0-10.0.6
  Fixed in: 10.0.7
• Microsoft — Microsoft.AspNetCore.DataProtection.EntityFrameworkCore
  Vulnerable versions: 10.0.0-10.0.6
  Fixed in: 10.0.7
• Microsoft — .NET Runtime
  Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
  Fixed in: 10.0.7
• Microsoft — .NET SDK
  Vulnerable versions: 10.0.100; 10.0.101; 10.0.102; 10.0.103; 10.0.104; 10.0.105; 10.0.106
  Fixed in: 10.0.107
• Microsoft — ASP.NET Core Hosting Bundle
  Vulnerable versions: 10.0.0-10.0.6
  Fixed in: 10.0.7
• Microsoft — Azure App Service (Windows/Linux .NET 10 stack)
  Vulnerable versions: runtime 10.0.0-10.0.6
  Fixed in: runtime 10.0.7 via platform auto-upgrade 2026-04-22

Timeline of ASP.NET Core cookie forgery

• 2026-04-08 Microsoft ships .NET 10.0.6 as part of the April 2026 Patch Tuesday release. KeyRingBasedDataProtector refactor silently introduces the cryptographic regression that becomes CVE-2026-40372.
• 2026-04-14 Azure security telemetry flags anomalous cookie-validation success rates across multiple App Service tenants; Microsoft engineering begins internal root-cause investigation.
• 2026-04-16 Independent researchers reverse-engineer the 10.0.6 diff, identify the forgery primitive, and develop a working proof-of-concept against a test application.
• 2026-04-18 Researchers submit coordinated disclosure to Microsoft Security Response Center (MSRC). MSRC confirms the issue and begins OOB patch preparation.
• 2026-04-20 Microsoft finalizes .NET 10.0.7 runtime and SDK builds with reverted KeyRingBasedDataProtector code path; internal validation completes.
• 2026-04-22 Threadlinqs Intelligence publishes TL-2026-0408 analysis with MITRE mapping, detection content, and attack simulations for defenders.
• 2026-04-22 BleepingComputer, The Register, and major security vendors publish coverage; public exploit research begins and preliminary POC code surfaces on GitHub.
• 2026-04-22 Microsoft publishes CVE-2026-40372 advisory, releases .NET 10.0.7 OOB runtime/SDK/hosting-bundle/container images, and begins automatic Azure App Service platform upgrade.
• 2026-05-29 As of 2026-05-29, CVE-2026-40372 is fixed by the OOB .NET 10.0.7 release (2026-04-22) with Azure auto-patched, and Microsoft plus May vendor roundups report no in-the-wild exploitation; it is NOT in CISA KEV. Residual risk persists on unpatched/un-key-rotated hosts where forged cookies stay valid, and public PoC tooling exists.

Sources cited for ASP.NET Core cookie forgery

• Microsoft Security Advisory CVE-2026-40372 Microsoft Security Response Center · Advisory · 2026-04-22
• NVD Entry CVE-2026-40372 NVD (NIST) · Advisory · 2026-04-22
• CISA Alert — Critical Microsoft ASP.NET Core Vulnerability CISA · Government advisory · 2026-04-22
• Microsoft.AspNetCore.DataProtection on NuGet nuget.org · Vendor report · 2026-04-22
• Announcing .NET 10 Patch Release April 2026 (OOB) Microsoft · Vendor report · 2026-04-22
• ASP.NET Core Data Protection Documentation Microsoft · Vendor report · 2026-04-22
• Rapid7 Analysis — CVE-2026-40372 Exploitability Breakdown Rapid7 · Research · 2026-04-22
• .NET 10.0.7 Release Notes GitHub · Code repository · 2026-04-22
• Microsoft releases emergency security updates for critical ASP.NET flaw BleepingComputer · News · 2026-04-22
• The Register — Microsoft rushes OOB patch for critical .NET bug The Register · News · 2026-04-22

Threats related to ASP.NET Core cookie forgery

• Microsoft SharePoint Server Deserialization RCE (CVE-2026-20963) — CISA KEV Active Exploitation
• ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372)