# CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation

> Microsoft released an out-of-band emergency patch on 2026-04-22 for CVE-2026-40372, a CVSS 9.8 cryptographic regression in Microsoft.AspNetCore.DataProtection introduced with .NET 10.0.6 (April Patch Tuesday). The flaw lets unauthenticated network attackers forge authentication cookies, antiforgery tokens, and other protected payloads, leading to full authentication bypass and, on IIS application pools running as LocalSystem, SYSTEM-level remote code execution. All ASP.NET Core applications on .NET runtime 10.0.0 through 10.0.6 are affected; the fix is .NET 10.0.7.

- **Published:** 2026-04-22T12:00:00Z
- **Last reviewed:** 2026-04-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0408
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-asp-net-core-cookie-forgery-tl-2026-0408.webp?v=4cddfe69 (Threadlinqs threat intel: CVE-2026-40372 ASP.NET Core Auth Bypass: Detection & IOCs (TL-2026-0408) — Critical severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-0408
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 25
- **CVEs:** CVE-2026-40372

## Description

CVE-2026-40372 is a critical cryptographic flaw in the Microsoft.AspNetCore.DataProtection stack — the library that underpins virtually every secure-at-rest ASP.NET Core primitive, including authentication cookies, antiforgery tokens, OAuth/OpenID state tokens, TempData providers, data-protected query strings, and any consumer of IDataProtector.Protect/Unprotect. The issue was introduced as a regression in the April 2026 Patch Tuesday release of .NET 10.0.6 when Microsoft refactored the key-ring rotation logic inside KeyRingBasedDataProtector to improve cold-start performance. During that refactor, a fallback path unintentionally permitted a caller-controlled purpose string combined with a predictable HMAC subkey, allowing an attacker to craft an authenticator that the validator accepts as a legitimately signed, non-tampered payload. Independent researchers disclosed working forgery primitives to MSRC on 2026-04-18, and Microsoft shipped an OOB security update four days later on 2026-04-22.

Exploitation is unauthenticated, network-reachable, and deterministic. An attacker needs only the externally observable base64 key identifier embedded in a legitimate Set-Cookie response to fingerprint the victim key-ring version. From that, they derive a forgery oracle that can mint arbitrary claims inside .AspNetCore.Cookies, .AspNetCore.Identity.Application, or any customer-named cookie that uses the default data-protection purpose. Forged cookies decrypt cleanly on the server and are indistinguishable from legitimate authentications at the application layer — no TLS break, no XSS, no CSRF, no valid credential required.

The severity jumps from authentication bypass to SYSTEM compromise because of how ASP.NET Core applications are typically hosted: IIS in-process hosting runs application pools under the ApplicationPoolIdentity account by default, but a significant fraction of enterprise deployments explicitly elevate pools to LocalSystem for service-account DPAPI access, Kerberos constrained delegation, or legacy WebForms interop. A forged authentication cookie granting administrator role membership therefore lands the attacker directly inside a SYSTEM-privileged worker process. From there, any deserialization sink, admin-only file upload, or management endpoint (ELMAH, Hangfire, Orchard Core, Umbraco, Sitecore, custom management UIs) becomes a SYSTEM RCE primitive without a second vulnerability.

Microsoft Security Response Center rates the vulnerability 9.8 CRITICAL with CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA is expected to add CVE-2026-40372 to the Known Exploited Vulnerabilities catalog within the standard 14-day Binding Operational Directive 22-01 window given the OOB release and trivial exploit development cost. Affected packages include Microsoft.AspNetCore.DataProtection, Microsoft.AspNetCore.DataProtection.Extensions, Microsoft.AspNetCore.DataProtection.StackExchangeRedis, and Microsoft.AspNetCore.DataProtection.EntityFrameworkCore at versions 10.0.0 through 10.0.6. The Azure App Service platform began automatic runtime upgrades on 2026-04-22 17:00 UTC; self-hosted applications and containerized workloads require manual patching to .NET 10.0.7 or rotation of data-protection keys after patching.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1550 Use Alternate Authentication Material
- T1685 Disable or Modify Tools
- T1606 Forge Web Credentials
- T1518 Software Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ASP.NET Core Forged Data-Protection Cookie Accepted Without Preceding Sign-In (CVE-2026-40372) — Exploitation** (`TL-2026-0408-SPL-001`)

Detects the primary exploitation signature for CVE-2026-40372: an ASP.NET Core authentication cookie (.AspNetCore.Cookies / .AspNetCore.Identity.Application) is presented and accepted at a protected endpoint, but no preceding interactive sign-in event exists for the same session/user in the identity audit log within a rolling 10-minute window. This correlation gap is the canonical indicator of a forged data-protection cookie.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1606.001, T1190, T1550.004
- **Data sources:** iis, nginx, aspnetcore_identity, azure_signinlogs, webserver_access_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype IN ("iis:access","ms:iis:default","nginx:plus:access","nginx:plus:kv") (cs_Cookie="*.AspNetCore.Cookies=*" OR cs_Cookie="*.AspNetCore.Identity.Application=*" OR cookie="*.AspNetCore.Cookies=*" OR cookie="*.AspNetCore.Identity.Application=*") cs_uri_stem IN ("/admin/*","/Identity/Account/Manage*","/umbraco/*","/sitecore/*","/orchard/*","/hangfire/*","/elmah.axd") sc_status IN (200,302)
| rex field=cs_Cookie "\.AspNetCore\.(?:Cookies|Identity\.Application)=(?<cookie_val>CfDJ8[A-Za-z0-9_\-]+)"
| eval session_key=coalesce(cookie_val,"unknown"), client_ip=coalesce(c_ip,src_ip)
| join type=left session_key [
    search index=identity sourcetype IN ("aspnetcore:identity","ms:aspnet:auth","aspnetcore:signin") event_type IN ("SignIn","LoginSuccess","Authentication") earliest=-10m@m
    | rex field=_raw "cookie_id=(?<session_key>CfDJ8[A-Za-z0-9_\-]+)"
    | stats max(_time) as signin_time by session_key
  ]
| where isnull(signin_time)
| stats count as forged_hits, values(cs_uri_stem) as endpoints, values(client_ip) as src_ips, min(_time) as first_seen, max(_time) as last_seen by session_key
| where forged_hits >= 1
| eval severity="critical", cve="CVE-2026-40372"
| table first_seen last_seen session_key src_ips endpoints forged_hits severity cve
```

### Microsoft KQL

```kql
// CVE-2026-40372 — Forged ASP.NET Core auth cookie accepted without preceding sign-in
let window = 10m;
let cookie_hits = W3CIISLog
| where TimeGenerated > ago(24h)
| where csCookie has_any (".AspNetCore.Cookies=", ".AspNetCore.Identity.Application=")
| where csUriStem has_any ("/admin/", "/Identity/Account/Manage", "/umbraco/", "/sitecore/", "/orchard/", "/hangfire/", "/elmah.axd")
| where scStatus in (200, 302)
| extend cookie_val = extract(@"\.AspNetCore\.(?:Cookies|Identity\.Application)=(CfDJ8[A-Za-z0-9_\-]+)", 1, csCookie)
| where isnotempty(cookie_val)
| project CookieHitTime = TimeGenerated, cookie_val, cIp, csUriStem, Computer;
let signin_events = SigninLogs
| where TimeGenerated > ago(24h + window)
| where ResultType == 0
| extend cookie_val = tostring(parse_json(tostring(AuthenticationDetails))[0].CookieId)
| where isnotempty(cookie_val)
| project SigninTime = TimeGenerated, cookie_val;
cookie_hits
| join kind=leftouter (signin_events) on cookie_val
| where isnull(SigninTime) or datetime_diff('minute', CookieHitTime, SigninTime) > 10
| summarize forged_hits = count(), endpoints = make_set(csUriStem), src_ips = make_set(cIp), first_seen = min(CookieHitTime), last_seen = max(CookieHitTime) by cookie_val, Computer
| where forged_hits >= 1
| extend severity = "Critical", cve = "CVE-2026-40372"
| project first_seen, last_seen, cookie_val, src_ips, endpoints, forged_hits, Computer, severity, cve
```

### Sigma

```yaml
title: ASP.NET Core Forged Data-Protection Cookie Accepted Without Preceding Sign-In (CVE-2026-40372)
id: 3f9a2c48-40d7-4b21-9f77-1c2e4a5b7f01
status: experimental
description: Detects the primary exploitation signature for CVE-2026-40372 — an ASP.NET Core authentication cookie accepted at a protected admin endpoint with no corresponding interactive sign-in within the correlation window, indicating a forged data-protection cookie.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40372
    - https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/22
tags:
    - attack.credential_access
    - attack.initial_access
    - attack.t1606.001
    - attack.t1190
    - attack.t1550.004
    - cve.2026.40372
logsource:
    category: webserver
detection:
    selection_cookie:
        cs-Cookie|contains:
            - '.AspNetCore.Cookies='
            - '.AspNetCore.Identity.Application='
    selection_endpoint:
        cs-uri-stem|contains:
            - '/admin/'
            - '/Identity/Account/Manage'
            - '/umbraco/'
            - '/sitecore/'
            - '/orchard/'
            - '/hangfire/'
            - '/elmah.axd'
    selection_status:
        sc-status:
            - 200
            - 302
    filter_signin_correlated:
        SigninEventCorrelated: true
    condition: selection_cookie and selection_endpoint and selection_status and not filter_signin_correlated
falsepositives:
    - Legitimate long-lived persistent cookies where the corresponding sign-in event has rolled out of the correlation window
    - Internal API clients that carry session cookies without a user sign-in flow
level: critical

```

**Known false positives:**

- Legitimate persistent-cookie flows where the preceding sign-in has aged past the 10-minute correlation window
- Internal service-to-service calls that reuse session cookies without interactive authentication

**Tuning notes:** Adjust the correlation window (default 10 minutes) to match your session lifetime. Whitelist internal health-check IPs and known service principals. Verify your identity log sink (Azure SigninLogs, on-prem Identity audit) exposes a correlatable cookie_id / session_id field; if not, correlate on (user, client_ip) tuples as a fallback.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ASP.NET Core DataProtection Unprotect-Without-Protect Purpose-String Anomaly (CVE-2026-40372) — Exploitation (locked: unlock with TL Creds)
- Direct Admin-Endpoint Access Without Login-Flow Hit — ASP.NET Core (CVE-2026-40372) — Exploitation (locked: unlock with TL Creds)
- IIS w3wp.exe Spawning Interactive Shell After Admin-Endpoint Hit (CVE-2026-40372) — Post-Exploitation (locked: unlock with TL Creds)
- Unusual Read Access to ASP.NET Core DataProtection Key-Ring Storage (CVE-2026-40372) — Post-Exploitation (locked: unlock with TL Creds)
- Vulnerable Microsoft.AspNetCore.DataProtection Assembly Loaded or Present (CVE-2026-40372) — Post-Exploitation / Exposure (locked: unlock with TL Creds)
- Forged-Cookie Session Reuse Across Divergent Source IPs (CVE-2026-40372) — C2 / Lateral Movement (locked: unlock with TL Creds)
- Admin-Role Privileged Action From Never-Before-Seen Source IP (CVE-2026-40372) — C2 / Lateral Movement (locked: unlock with TL Creds)
- Outbound C2 Beacon From Web Worker After Admin-Role Authentication (CVE-2026-40372) — C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft releases emergency security updates for critical ASP.NET flaw](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-security-updates-for-critical-aspnet-flaw/)
- [Microsoft Security Advisory CVE-2026-40372](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372)
- [Microsoft.AspNetCore.DataProtection on NuGet](https://www.nuget.org/packages/Microsoft.AspNetCore.DataProtection)
- [.NET 10.0.7 Release Notes](https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.7/10.0.7.md)
- [Announcing .NET 10 Patch Release April 2026 (OOB)](https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security/)
- [NVD Entry CVE-2026-40372](https://nvd.nist.gov/vuln/detail/CVE-2026-40372)
- [ASP.NET Core Data Protection Documentation](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction)
- [CISA Alert — Critical Microsoft ASP.NET Core Vulnerability](https://www.cisa.gov/news-events/alerts/2026/04/22/microsoft-aspnetcore-cve-2026-40372)
- [The Register — Microsoft rushes OOB patch for critical .NET bug](https://www.theregister.com/2026/04/22/microsoft_oob_aspnet_dataprotection/)
- [Rapid7 Analysis — CVE-2026-40372 Exploitability Breakdown](https://www.rapid7.com/blog/post/2026/04/22/cve-2026-40372-aspnet-core-data-protection/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0408