ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372)

Key facts for ASP.NET Core 10 cookie forgery

Detection coverage for ASP.NET Core 10 cookie forgery

As of 2026-04-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0427 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Antiforgery Validation Failures Followed by Privileged Authentication — CVE-2026-40372 (SPL)

Splunk correlation that detects a source IP producing antiforgery token deserialization / decryption failures and then successfully authenticating as an Administrator or admin-tagged role within the same 10-minute window — the post-exploitation handshake of a CVE-2026-40372 forged-token submission that escalates a session to a privileged identity.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1606.001, T1068, T1550.004, T1078
• Data sources: aspnetcore_application_logs, aspnetcore_authentication_logs, iis_aspnetcore_module
• Severity: critical
• Confidence: high

Splunk SPL

index=aspnetcore sourcetype="aspnetcore:stdout" "Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery" ("AntiforgeryValidationException" OR "An exception was thrown while deserializing the token" OR "The antiforgery token could not be decrypted") | bin _time span=10m | stats count AS af_failures, values(session_id) AS sessions BY _time, src_ip | where af_failures >= 5 | join type=inner src_ip [     search index=aspnetcore sourcetype="aspnetcore:stdout"     "Microsoft.AspNetCore.Authentication" "SignInAsync"     ("Administrator" OR "admin" OR role=*admin*) earliest=-10m     | stats latest(_time) AS auth_time, values(user) AS authenticated_user BY src_ip ] | eval cve="CVE-2026-40372", phase="post-exploitation" | table _time, src_ip, af_failures, sessions, auth_time, authenticated_user, cve, phase

Microsoft KQL

let af = AppServiceConsoleLogs
    | where TimeGenerated > ago(1h)
    | where ResultDescription has "Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery"
    | where ResultDescription has_any ("AntiforgeryValidationException","An exception was thrown while deserializing the token","The antiforgery token could not be decrypted")
    | extend SourceIp = tostring(extract(@"(?:src_ip=|client=|RemoteIpAddress=)([0-9a-fA-F\.:]+)", 1, ResultDescription))
    | summarize AfFailures = count() by bin(TimeGenerated, 10m), SourceIp
    | where AfFailures >= 5;
let priv = SigninLogs
    | where TimeGenerated > ago(1h)
    | where ResultType == 0
    | where AppDisplayName has_any ("ASP.NET","aspnetcore") or ResourceDisplayName has "ASP.NET"
    | extend Roles = tostring(parse_json(tostring(AuthenticationDetails)).Roles)
    | where Roles has_any ("Administrator","admin");
af | join kind=inner priv on $left.SourceIp == $right.IPAddress
| project TimeGenerated, SourceIp, AfFailures, UserPrincipalName, Roles, AppDisplayName

Sigma

title: ASP.NET Core Antiforgery Failure Followed by Privileged Authentication (CVE-2026-40372)
id: 3e5f7a9b-0c1d-4e2f-8a3b-c403720004ee
status: experimental
description: |
    Antiforgery token deserialization or decryption failures from a single
    source IP that is then followed by a successful authentication into an
    Administrator or admin-tagged role within the same session window — a
    behaviour pattern consistent with CVE-2026-40372 forged-token submission
    (HMAC bypass in Microsoft.AspNetCore.DataProtection) leading to privilege
    elevation.
references:
    - https://github.com/dotnet/announcements/issues/395
    - https://socprime.com/blog/cve-2026-40372-detection/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/27
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1550.004
    - attack.t1606.001
    - attack.t1068
    - cve.2026.40372
logsource:
    product: aspnetcore
    category: application
detection:
    antiforgery_fail:
        Logger|contains: 'Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery'
        Message|contains:
            - 'An exception was thrown while deserializing the token'
            - 'AntiforgeryValidationException'
            - 'The antiforgery token could not be decrypted'
    privileged_auth:
        EventCategory: 'Authentication'
        Outcome: 'Success'
        Roles|contains:
            - 'Administrator'
            - 'admin'
    condition: antiforgery_fail and privileged_auth
fields:
    - SourceIp
    - SessionId
    - User
    - Roles
falsepositives:
    - Genuine antiforgery token expiry combined with admin re-authentication
    - Browser extensions that strip or rewrite cookies
level: high

Known false positives:

• Genuine antiforgery token expiry followed by admin re-authentication from the same IP
• Browser extensions or middleware that strip or rewrite anti-forgery cookies
• Bulk admin onboarding events where SSO and antiforgery cycle simultaneously

Tuning notes: Tune the af_failures>=5 threshold against the application's organic anti-forgery noise floor. Replace the role string match ('Administrator','admin') with the application's actual privileged role names (e.g., 'GlobalAdmin','tenant-owner','platform-engineer'). Consider widening the join window to 30 minutes for SPAs that lazy-load admin views well after sign-in.

• 🔒 DataProtection Unprotect Failure Burst — CVE-2026-40372 Probing (KQL / Sentinel) · unlock with TL Creds
• 🔒 IIS [indicator] Spawns Shell or LOLBin — CVE-2026-40372 Post-Forgery (KQL / Defender) · unlock with TL Creds
• 🔒 ASP.NET Core Auth Cookie Source Mismatch — CVE-2026-40372 Forged Session Reuse (KQL) · unlock with TL Creds
• 🔒 ASP.NET Core DataProtection Unprotect Failure Burst — CVE-2026-40372 (Sigma) · unlock with TL Creds
• 🔒 IIS Worker [indicator] Spawns Shell or LOLBin Post-Authentication — CVE-2026-40372 (Sigma) · unlock with TL Creds
• 🔒 Kestrel dotnet Host Spawns Unexpected Shell Children on Linux — CVE-2026-40372 (Sigma) · unlock with TL Creds
• 🔒 DataProtection Unprotect Failure Burst — CVE-2026-40372 Probing (SPL) · unlock with TL Creds
• 🔒 Outbound Network from IIS/dotnet Worker Post Forged-Cookie Activity — CVE-2026-40372 (SPL) · unlock with TL Creds

Indicators of compromise for ASP.NET Core 10 cookie forgery

As of 2026-04-27, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0427.

How ASP.NET Core 10 cookie forgery works

Microsoft shipped out-of-band emergency updates on 2026-04-21; data-protection key-ring rotation is mandatory after patching because forged tokens issued during the vulnerable window remain validly signed.

CVE-2026-40372 is a critical elevation-of-privilege vulnerability in the Microsoft.AspNetCore.DataProtection library that ships with .NET 10. The Data Protection API is the cryptographic spine of nearly every ASP.NET Core security primitive: cookie authentication tickets, anti-forgery tokens, OpenID Connect correlation cookies, TempData payloads, BearerToken state, ASP.NET Core Identity protected fields, OAuth state parameters, and any developer-authored use of IDataProtector.Protect / Unprotect.

A signature-verification weakness in the protected-payload format (CWE-347 Improper Verification of Cryptographic Signature) causes the framework to accept payloads whose HMAC tag is malformed in a specific way as legitimately signed. An unauthenticated network attacker who can submit HTTP requests to a vulnerable application can therefore craft and deliver arbitrary protected payloads that the server unprotects into trusted state. The most consequential primitive is forgery of the .AspNetCore.Cookies authentication ticket, which lets the attacker present themselves to the application as any user — including privileged accounts. On Windows IIS hosts this typically resolves to NT AUTHORITY\SYSTEM through the application-pool identity model, which is why Microsoft labels the impact as elevation of privilege to SYSTEM.

The attack requires no prior credential, no user interaction, and no privileged context on the attacker side. It cannot be mitigated by application-layer authorization, because the trust decision happens inside DataProtection unprotect — before any controller, filter, or downstream middleware executes. The CVSS 9.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low complexity, no privileges, no user interaction, and a scope change because forged Data Protection payloads compromise principals beyond the vulnerable component.

Affected packages: Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 inclusive. The fix ships in 10.0.7 alongside .NET SDK 10.0.107 and .NET runtime 10.0.7 in the out-of-band update on 2026-04-21. Self-contained deployments must be rebuilt against the patched library; framework-dependent deployments inherit the fix once the host runtime is patched.

Key-ring rotation is mandatory. Patching alone is insufficient: because the vulnerability lets attackers obtain payloads that are validly signed by the application''s current Data Protection key ring, every cookie or token forged before the patch will continue to be accepted by a patched server. Microsoft directs operators to (1) deploy the runtime/package patch, (2) revoke all keys in the active key ring via IKeyManager.RevokeAllKeys or the equivalent management UX, (3) generate a fresh key, (4) invalidate every active authentication session, and (5) audit logs for unexpected auth or anti-forgery validation events during the vulnerable window.

Exploitation status: Microsoft ranks exploitation as More Likely. As of 2026-04-27 there is no confirmed in-the-wild exploitation and no fully weaponized public proof-of-concept, but multiple detection vendors (CyCognito, SOC Prime) had published detection guidance within 24 hours of disclosure and the primitive is mechanically simple enough that public PoC release is expected within days.

Defenders must treat any internet-exposed ASP.NET Core 10 application as potentially compromised until both the package patch is deployed AND the data-protection key ring has been rotated. Partially-mitigated systems remain exposed to forged tokens issued during the vulnerable window. The blast radius is unusually broad because Microsoft.AspNetCore.DataProtection is shipped with the .NET 10 baseline rather than as an opt-in dependency, so virtually every ASP.NET Core 10 web application that uses cookie auth, anti-forgery protection, OpenID Connect, ASP.NET Core Identity, or any IDataProtector consumer is in scope.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1505.003 Server Software Component: Web Shell

Execution

T1203 Exploitation for Client Execution

Credential Access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials; T1606.001 Forge Web Credentials: Web Cookies

lateral-movement

T1550 Use Alternate Authentication Material; T1550.004 Use Alternate Authentication Material: Web Session Cookie

defense-impairment

T1556 Modify Authentication Process

Remediation for ASP.NET Core 10 cookie forgery

Patches

• Microsoft.AspNetCore.DataProtection 10.0.7 (NuGet)
• .NET 10 Runtime 10.0.7
• .NET 10 SDK 10.0.107
• ASP.NET Core 10 shared framework 10.0.7
• Microsoft April 2026 out-of-band cumulative update for affected Windows hosting models

Immediate actions

• Upgrade Microsoft.AspNetCore.DataProtection to 10.0.7 or later (NuGet) for self-contained apps; deploy .NET 10 runtime 10.0.7 / SDK 10.0.107 for framework-dependent apps
• After patching, revoke ALL keys in the active data-protection key ring (IKeyManager.RevokeAllKeys / Revoke-DataProtectionKey) and generate a fresh key — patches alone do NOT invalidate forged payloads issued during the vulnerable window
• Force re-authentication of every active session and invalidate persistent auth cookies, anti-forgery tokens, OIDC correlation cookies, BearerTokens, and TempData
• Inventory every ASP.NET Core 10 deployment (IIS, Kestrel, Azure App Service, Linux containers) and confirm each is on a fixed package or runtime version
• Audit web logs for the vulnerable window (any time a 10.0.0-10.0.6 build was internet-exposed) for anomalous authentication, privilege use, or anti-forgery validation events

Workarounds

• Until patched, restrict access to ASP.NET Core 10 endpoints to authenticated VPN / zero-trust ingress so unauthenticated payload submission is not possible
• For self-contained apps, rebuild and redeploy against the patched library — runtime patches alone do not fix self-contained deployments
• Disable cookie authentication and switch to externally-validated bearer tokens (issued by an independent IdP) as a temporary compensating control if patching is delayed

Longer-term hardening

• Centralize Data Protection key storage in an audited backend (Azure Key Vault, Redis with persistence, or DPAPI-NG with HSM) so rotations and accesses are observable
• Adopt a scheduled key-rotation cadence (e.g. 30-90 day default expiration) in PersistKeysToX configuration
• Instrument structured telemetry on IDataProtector unprotect failures, auth-ticket validation failures, and anti-forgery validation failures and alert on rate spikes
• Add SBOM-driven monitoring for Microsoft.AspNetCore.DataProtection version drift across deployed services
• Place ASP.NET Core 10 surfaces behind a zero-trust / WAF layer that performs independent identity verification rather than trusting only the ASP.NET Core auth cookie

Affected and fixed versions

• Microsoft — Microsoft.AspNetCore.DataProtection (NuGet)
  Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
  Fixed in: 10.0.7
• Microsoft — .NET 10 Runtime
  Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
  Fixed in: 10.0.7
• Microsoft — .NET 10 SDK
  Vulnerable versions: 10.0.100; 10.0.101; 10.0.102; 10.0.103; 10.0.104; 10.0.105; 10.0.106
  Fixed in: 10.0.107
• Microsoft — ASP.NET Core 10 Shared Framework
  Vulnerable versions: 10.0.0 through 10.0.6
  Fixed in: 10.0.7

Timeline of ASP.NET Core 10 cookie forgery

• 2025-11-12 .NET 10 GA released; Microsoft.AspNetCore.DataProtection 10.0.0 ships as part of the ASP.NET Core 10 baseline runtime.
• 2026-04-15 Microsoft Security Response Center receives internal disclosure of HMAC signature verification flaw in Microsoft.AspNetCore.DataProtection (estimated based on out-of-band release cadence).
• 2026-04-21 BleepingComputer publishes initial coverage of Microsoft emergency security updates for the critical ASP.NET flaw.
• 2026-04-21 .NET 10 Runtime 10.0.7 and SDK 10.0.107 released as out-of-band emergency updates; Microsoft.AspNetCore.DataProtection 10.0.7 published to NuGet.
• 2026-04-21 Microsoft publishes CVE-2026-40372 advisory in dotnet/announcements#395 and dotnet/aspnetcore#66410; out-of-band patch ships as 10.0.7.
• 2026-04-22 Microsoft updates exploitability index entry for CVE-2026-40372 to More Likely; no public PoC observed yet.
• 2026-04-22 SOC Prime publishes Sigma-format detection guidance for CVE-2026-40372 anomalous unprotect / authentication patterns.
• 2026-04-22 The Hacker News and Security Affairs publish detailed coverage; CyCognito releases emerging-threat analysis.
• 2026-04-27 Threadlinqs Intelligence publishes complete research, simulation, and detection coverage for CVE-2026-40372 (TL-2026-0427).
• 2026-05-29 As of 2026-05-29, CVE-2026-40372 (ASP.NET Core DataProtection cookie forgery, CVSS 9.1) is fixed in the out-of-band .NET 10.0.7 update shipped 2026-04-21. No confirmed in-the-wild exploitation, no public weaponized PoC, and not in CISA KEV; residual risk only on unpatched/unrotated key rings.

Sources cited for ASP.NET Core 10 cookie forgery

• Microsoft Security Advisory CVE-2026-40372 — ASP.NET Core Elevation of Privilege (dotnet/announcements#395) GitHub · Advisory · 2026-04-21
• GitLab Advisory Database — Microsoft.AspNetCore.DataProtection CVE-2026-40372 GitLab · Advisory · 2026-04-21
• ASP.NET Core Data Protection key management documentation Microsoft · Vendor report · 2026-04-21
• ASP.NET Core Data Protection key revocation guidance Microsoft · Vendor report · 2026-04-21
• ASP.NET Core repo issue #66410 — CVE-2026-40372 GitHub · Code repository · 2026-04-21
• Emerging Threat: CVE-2026-40372 ASP.NET Core Privilege Escalation via Signature Bypass — CyCognito cycognito.com · Blog · 2026-04-22
• CVE-2026-40372: ASP.NET Core Privilege Escalation Detection — SOC Prime socprime.com · Blog · 2026-04-22
• Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug — The Hacker News The Hacker News · News · 2026-04-22
• Microsoft releases emergency security updates for critical ASP.NET flaw — BleepingComputer BleepingComputer · News · 2026-04-21
• Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw — Security Affairs securityaffairs.com · News · 2026-04-22

Threats related to ASP.NET Core 10 cookie forgery

• CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation
• CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing
• SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass
• CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)
• CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Actively Exploited, Added to CISA KEV