ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372) — Threadlinqs Intelligence
As of 2026-05-30, ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0427 · Severity: CRITICAL · CVSS: 9.1 · Status: PATCHED · Category: VULNERABILITY
Critical (CVSS 9.1) authentication-cookie-forgery flaw in Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6. Improper HMAC signature verification lets unauthenticated remote attackers forge
CVE-2026-40372 is a critical elevation-of-privilege vulnerability in the Microsoft.AspNetCore.DataProtection library that ships with .NET 10. The Data Protection API is the cryptographic spine of nearly every ASP.NET Core security primitive: cookie authentication tickets, anti-forgery tokens, OpenID Connect correlation cookies, TempData payloads, BearerToken state, ASP.NET Core Identity protected fields, OAuth state parameters, and any developer-authored use of IDataProtector.Protect / Unprotect.
A signature-verification weakness in the protected-payload format (CWE-347 Improper Verification of Cryptographic Signature) causes the framework to accept payloads whose HMAC tag is malformed in a specific way as legitimately signed. An unauthenticated network attacker who can submit HTTP requests to a vulnerable application can therefore craft and deliver arbitrary protected payloads that the server unprotects into trusted state. The most consequential primitive is forgery of the .AspNetCore.Cookies authentication ticket, which lets the attacker present themselves to the application as any user — including privileged accounts. On Windows IIS hosts this typically resolves to NT AUTHORITY\SYSTEM through the application-pool identity model, which is why Microsoft labels the impact as elevation of privilege to SYSTEM.
The attack requires no prior credential, no user interaction, and no privileged context on the attacker side. It cannot be mitigated by application-layer authorization, because the trust decision happens inside DataProtection unprotect — before any controller, filter, or downstream middleware executes. The CVSS 9.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low complexity, no privileges, no user interaction, and a scope change because forged Data Protection payloads compromise principals beyond the vulnerable component.
Affected packages: Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 inclusive. The fix ships in 10.0.7 alongside .NET SDK 10.0.107 and .NET runtime 10.0.7 in the out-of-band update on 2026-04-21. Self-contained deployments must be rebuilt against the patched library; framework-dependent deployments inherit the fix once the host runtime is patched.
Key-ring rotation is mandatory. Patching alone is insufficient: because the vulnerability lets attackers obtain payloads that are validly signed by the application''s current Data Protection key ring, every cookie or token forged before the patch will continue to be accepted by a patched server. Microsoft directs operators to (1) deploy the runtime/package patch, (2) revoke all keys in the active key ring via IKeyManager.RevokeAllKeys or the equivalent management UX, (3) generate a fresh key, (4) invalidate every active authentication session, and (5) audit logs for unexpected auth or anti-forgery validation events during the vulnerable window.
Exploitation status: Microsoft ranks exploitation as More Likely. As of 2026-04-27 there is no confirmed in-the-wild exploitation and no fully weaponized public proof-of-concept, but multiple detection vendors (CyCognito, SOC Prime) had published detection guidance within 24 hours of disclosure and the primitive is mechanically simple enough that public PoC release is expected within days.
Defenders must treat any internet-exposed ASP.NET Core 10 application as potentially compromised until both the package patch is deployed AND the data-protection key ring has been rotated. Partially-mitigated systems remain exposed to forged tokens issued during the vulnerable window. The blast radius is unusually broad because Microsoft.AspNetCore.DataProtection is shipped with the .NET 10 baseline rather than as an opt-in dependency, so virtually every ASP.NET Core 10 web application that uses cookie auth, anti-forgery protection, OpenID Connect, ASP.NET Core Identity, or any IDataProtector consumer is in scope.
Weaknesses (CWE)
CWE-347, CWE-345, CWE-287, CWE-863
Target sectors: government, financial, healthcare, technology, retail, education, manufacturing, energy, telecommunications, professional-services
Target regions: Global
Timeline
- .NET 10 GA released; Microsoft.AspNetCore.DataProtection 10.0.0 ships as part of the ASP.NET Core 10 baseline runtime.
- Microsoft Security Response Center receives internal disclosure of HMAC signature verification flaw in Microsoft.AspNetCore.DataProtection (estimated based on out-of-band release cadence).
- Microsoft publishes CVE-2026-40372 advisory in dotnet/announcements#395 and dotnet/aspnetcore#66410; out-of-band patch ships as 10.0.7.
- .NET 10 Runtime 10.0.7 and SDK 10.0.107 released as out-of-band emergency updates; Microsoft.AspNetCore.DataProtection 10.0.7 published to NuGet.
- BleepingComputer publishes initial coverage of Microsoft emergency security updates for the critical ASP.NET flaw.
- The Hacker News and Security Affairs publish detailed coverage; CyCognito releases emerging-threat analysis.
- SOC Prime publishes Sigma-format detection guidance for CVE-2026-40372 anomalous unprotect / authentication patterns.
- Microsoft updates exploitability index entry for CVE-2026-40372 to More Likely; no public PoC observed yet.
- Threadlinqs Intelligence publishes complete research, simulation, and detection coverage for CVE-2026-40372 (TL-2026-0427).
- As of 2026-05-29, CVE-2026-40372 (ASP.NET Core DataProtection cookie forgery, CVSS 9.1) is fixed in the out-of-band .NET 10.0.7 update shipped 2026-04-21. No confirmed in-the-wild exploitation, no public weaponized PoC, and not in CISA KEV; residual risk only on unpatched/unrotated key rings.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-40372, T1190, T1078, T1212, T1539, T1606, T1606.001, T1068, T1550.004, T1556, T1550
