ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372)
ASP.NET Core Data Protection Authentication Cookie Forgery / (TL-2026-0427), also tracked as ASP.NET Core Data Protection Signature Bypass, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-04-27. It has no confirmed attribution, affects Microsoft Microsoft.AspNetCore.DataProtection (NuGet), references 1 CVE (CVE-2026-40372), maps to 13 MITRE ATT&CK techniques (T1068, T1078, T1098), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0427
- Threat ID
- TL-2026-0427
- Also known as
- ASP.NET Core Data Protection Signature Bypass, DataProtection HMAC Bypass, ASP.NET Core 10 Cookie Forgery
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-04-27
- Last reviewed
- 2026-04-27
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, technology, retail, education, manufacturing, energy, telecommunications, professional-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Critical (CVSS 9.1) authentication-cookie-forgery flaw in Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6. Improper HMAC signature verification lets unauthenticated remote attackers forge protected payloads (auth cookies, anti-forgery tokens, signed state) and elevate privileges up to NT AUTHORITY\SYSTEM on any ASP.NET Core 10 web application. Microsoft shipped out-of-band emergency updates on 2026-04-21; data-protection key-ring rotation is mandatory after patching because forged tokens issued during the vulnerable window remain validly signed.
How ASP.NET Core Data Protection Authentication Cookie Forgery / works
CVE-2026-40372 is a critical elevation-of-privilege vulnerability in the Microsoft.AspNetCore.DataProtection library that ships with .NET 10. The Data Protection API is the cryptographic spine of nearly every ASP.NET Core security primitive: cookie authentication tickets, anti-forgery tokens, OpenID Connect correlation cookies, TempData payloads, BearerToken state, ASP.NET Core Identity protected fields, OAuth state parameters, and any developer-authored use of IDataProtector.Protect / Unprotect.
A signature-verification weakness in the protected-payload format (CWE-347 Improper Verification of Cryptographic Signature) causes the framework to accept payloads whose HMAC tag is malformed in a specific way as legitimately signed. An unauthenticated network attacker who can submit HTTP requests to a vulnerable application can therefore craft and deliver arbitrary protected payloads that the server unprotects into trusted state. The most consequential primitive is forgery of the .AspNetCore.Cookies authentication ticket, which lets the attacker present themselves to the application as any user — including privileged accounts. On Windows IIS hosts this typically resolves to NT AUTHORITY\SYSTEM through the application-pool identity model, which is why Microsoft labels the impact as elevation of privilege to SYSTEM.
The attack requires no prior credential, no user interaction, and no privileged context on the attacker side. It cannot be mitigated by application-layer authorization, because the trust decision happens inside DataProtection unprotect — before any controller, filter, or downstream middleware executes. The CVSS 9.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low complexity, no privileges, no user interaction, and a scope change because forged Data Protection payloads compromise principals beyond the vulnerable component.
Affected packages: Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 inclusive. The fix ships in 10.0.7 alongside .NET SDK 10.0.107 and .NET runtime 10.0.7 in the out-of-band update on 2026-04-21. Self-contained deployments must be rebuilt against the patched library; framework-dependent deployments inherit the fix once the host runtime is patched.
Key-ring rotation is mandatory. Patching alone is insufficient: because the vulnerability lets attackers obtain payloads that are validly signed by the application''s current Data Protection key ring, every cookie or token forged before the patch will continue to be accepted by a patched server. Microsoft directs operators to (1) deploy the runtime/package patch, (2) revoke all keys in the active key ring via IKeyManager.RevokeAllKeys or the equivalent management UX, (3) generate a fresh key, (4) invalidate every active authentication session, and (5) audit logs for unexpected auth or anti-forgery validation events during the vulnerable window.
Exploitation status: Microsoft ranks exploitation as More Likely. As of 2026-04-27 there is no confirmed in-the-wild exploitation and no fully weaponized public proof-of-concept, but multiple detection vendors (CyCognito, SOC Prime) had published detection guidance within 24 hours of disclosure and the primitive is mechanically simple enough that public PoC release is expected within days.
Defenders must treat any internet-exposed ASP.NET Core 10 application as potentially compromised until both the package patch is deployed AND the data-protection key ring has been rotated. Partially-mitigated systems remain exposed to forged tokens issued during the vulnerable window. The blast radius is unusually broad because Microsoft.AspNetCore.DataProtection is shipped with the .NET 10 baseline rather than as an opt-in dependency, so virtually every ASP.NET Core 10 web application that uses cookie auth, anti-forgery protection, OpenID Connect, ASP.NET Core Identity, or any IDataProtector consumer is in scope.
MITRE ATT&CK techniques used in TL-2026-0427
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1505.003 Server Software Component: Web Shell
Execution
T1203 Exploitation for Client Execution
Credential Access
T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1606 Forge Web Credentials; T1606.001 Forge Web Credentials: Web Cookies
lateral-movement
T1550 Use Alternate Authentication Material; T1550.004 Use Alternate Authentication Material: Web Session Cookie
defense-impairment
Affected products and versions in ASP.NET Core Data Protection Authentication Cookie Forgery /
- Microsoft — Microsoft.AspNetCore.DataProtection (NuGet)
Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
Fixed in: 10.0.7 - Microsoft — .NET 10 Runtime
Vulnerable versions: 10.0.0; 10.0.1; 10.0.2; 10.0.3; 10.0.4; 10.0.5; 10.0.6
Fixed in: 10.0.7 - Microsoft — .NET 10 SDK
Vulnerable versions: 10.0.100; 10.0.101; 10.0.102; 10.0.103; 10.0.104; 10.0.105; 10.0.106
Fixed in: 10.0.107 - Microsoft — ASP.NET Core 10 Shared Framework
Vulnerable versions: 10.0.0 through 10.0.6
Fixed in: 10.0.7
Remediation for ASP.NET Core Data Protection Authentication Cookie Forgery /
Patches
- Microsoft.AspNetCore.DataProtection 10.0.7 (NuGet)
- .NET 10 Runtime 10.0.7
- .NET 10 SDK 10.0.107
- ASP.NET Core 10 shared framework 10.0.7
- Microsoft April 2026 out-of-band cumulative update for affected Windows hosting models
Immediate actions
- Upgrade Microsoft.AspNetCore.DataProtection to 10.0.7 or later (NuGet) for self-contained apps; deploy .NET 10 runtime 10.0.7 / SDK 10.0.107 for framework-dependent apps
- After patching, revoke ALL keys in the active data-protection key ring (IKeyManager.RevokeAllKeys / Revoke-DataProtectionKey) and generate a fresh key — patches alone do NOT invalidate forged payloads issued during the vulnerable window
- Force re-authentication of every active session and invalidate persistent auth cookies, anti-forgery tokens, OIDC correlation cookies, BearerTokens, and TempData
- Inventory every ASP.NET Core 10 deployment (IIS, Kestrel, Azure App Service, Linux containers) and confirm each is on a fixed package or runtime version
- Audit web logs for the vulnerable window (any time a 10.0.0-10.0.6 build was internet-exposed) for anomalous authentication, privilege use, or anti-forgery validation events
Workarounds
- Until patched, restrict access to ASP.NET Core 10 endpoints to authenticated VPN / zero-trust ingress so unauthenticated payload submission is not possible
- For self-contained apps, rebuild and redeploy against the patched library — runtime patches alone do not fix self-contained deployments
- Disable cookie authentication and switch to externally-validated bearer tokens (issued by an independent IdP) as a temporary compensating control if patching is delayed
Longer-term hardening
- Centralize Data Protection key storage in an audited backend (Azure Key Vault, Redis with persistence, or DPAPI-NG with HSM) so rotations and accesses are observable
- Adopt a scheduled key-rotation cadence (e.g. 30-90 day default expiration) in PersistKeysToX configuration
- Instrument structured telemetry on IDataProtector unprotect failures, auth-ticket validation failures, and anti-forgery validation failures and alert on rate spikes
- Add SBOM-driven monitoring for Microsoft.AspNetCore.DataProtection version drift across deployed services
- Place ASP.NET Core 10 surfaces behind a zero-trust / WAF layer that performs independent identity verification rather than trusting only the ASP.NET Core auth cookie
CVEs associated with ASP.NET Core Data Protection Authentication Cookie Forgery /
Weaknesses (CWE) in ASP.NET Core Data Protection Authentication Cookie Forgery /
CWE-347, CWE-345, CWE-287, CWE-863
Timeline of ASP.NET Core Data Protection Authentication Cookie Forgery /
- .NET 10 GA released; Microsoft.AspNetCore.DataProtection 10.0.0 ships as part of the ASP.NET Core 10 baseline runtime.
- Microsoft Security Response Center receives internal disclosure of HMAC signature verification flaw in Microsoft.AspNetCore.DataProtection (estimated based on out-of-band release cadence).
- BleepingComputer publishes initial coverage of Microsoft emergency security updates for the critical ASP.NET flaw.
- .NET 10 Runtime 10.0.7 and SDK 10.0.107 released as out-of-band emergency updates; Microsoft.AspNetCore.DataProtection 10.0.7 published to NuGet.
- Microsoft publishes CVE-2026-40372 advisory in dotnet/announcements#395 and dotnet/aspnetcore#66410; out-of-band patch ships as 10.0.7.
- Microsoft updates exploitability index entry for CVE-2026-40372 to More Likely; no public PoC observed yet.
- SOC Prime publishes Sigma-format detection guidance for CVE-2026-40372 anomalous unprotect / authentication patterns.
- The Hacker News and Security Affairs publish detailed coverage; CyCognito releases emerging-threat analysis.
- Threadlinqs Intelligence publishes complete research, simulation, and detection coverage for CVE-2026-40372 (TL-2026-0427).
- As of 2026-05-29, CVE-2026-40372 (ASP.NET Core DataProtection cookie forgery, CVSS 9.1) is fixed in the out-of-band .NET 10.0.7 update shipped 2026-04-21. No confirmed in-the-wild exploitation, no public weaponized PoC, and not in CISA KEV; residual risk only on unpatched/unrotated key rings.
Sources cited for ASP.NET Core Data Protection Authentication Cookie Forgery /
- Microsoft Security Advisory CVE-2026-40372 — ASP.NET Core Elevation of Privilege (dotnet/announcements#395)
- ASP.NET Core repo issue #66410 — CVE-2026-40372
- GitLab Advisory Database — Microsoft.AspNetCore.DataProtection CVE-2026-40372
- Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug — The Hacker News
- Microsoft releases emergency security updates for critical ASP.NET flaw — BleepingComputer
- Emerging Threat: CVE-2026-40372 ASP.NET Core Privilege Escalation via Signature Bypass — CyCognito
- CVE-2026-40372: ASP.NET Core Privilege Escalation Detection — SOC Prime
- Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw — Security Affairs
- ASP.NET Core Data Protection key management documentation
- ASP.NET Core Data Protection key revocation guidance
Threats related to ASP.NET Core Data Protection Authentication Cookie Forgery /
- CVE-2026-40372: ASP.NET Core Data Protection Authentication Cookie Forgery Enables Unauthenticated SYSTEM Privilege Escalation
- CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing
- SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass
- CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)
- CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Actively Exploited, Added to CISA KEV
Detection coverage for TL-2026-0427
As of 2026-04-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0427 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.