# ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372)

> Critical (CVSS 9.1) authentication-cookie-forgery flaw in Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6. Improper HMAC signature verification lets unauthenticated remote attackers forge protected payloads (auth cookies, anti-forgery tokens, signed state) and elevate privileges up to NT AUTHORITY\SYSTEM on any ASP.NET Core 10 web application. Microsoft shipped out-of-band emergency updates on 2026-04-21; data-protection key-ring rotation is mandatory after patching because forged tokens issued during the vulnerable window remain validly signed.

- **Published:** 2026-04-27T12:00:00Z
- **Last reviewed:** 2026-04-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0427
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-asp-net-core-10-cookie-forgery-tl-2026-0427.webp?v=969222b7 (Threadlinqs threat intel: CVE-2026-40372 ASP.NET Cookie Forgery: Detection & IOCs (TL-2026-0427) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0427
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 20
- **CVEs:** CVE-2026-40372

## Description

CVE-2026-40372 is a critical elevation-of-privilege vulnerability in the Microsoft.AspNetCore.DataProtection library that ships with .NET 10. The Data Protection API is the cryptographic spine of nearly every ASP.NET Core security primitive: cookie authentication tickets, anti-forgery tokens, OpenID Connect correlation cookies, TempData payloads, BearerToken state, ASP.NET Core Identity protected fields, OAuth state parameters, and any developer-authored use of IDataProtector.Protect / Unprotect.

A signature-verification weakness in the protected-payload format (CWE-347 Improper Verification of Cryptographic Signature) causes the framework to accept payloads whose HMAC tag is malformed in a specific way as legitimately signed. An unauthenticated network attacker who can submit HTTP requests to a vulnerable application can therefore craft and deliver arbitrary protected payloads that the server unprotects into trusted state. The most consequential primitive is forgery of the .AspNetCore.Cookies authentication ticket, which lets the attacker present themselves to the application as any user — including privileged accounts. On Windows IIS hosts this typically resolves to NT AUTHORITY\SYSTEM through the application-pool identity model, which is why Microsoft labels the impact as elevation of privilege to SYSTEM.

The attack requires no prior credential, no user interaction, and no privileged context on the attacker side. It cannot be mitigated by application-layer authorization, because the trust decision happens inside DataProtection unprotect — before any controller, filter, or downstream middleware executes. The CVSS 9.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low complexity, no privileges, no user interaction, and a scope change because forged Data Protection payloads compromise principals beyond the vulnerable component.

Affected packages: Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 inclusive. The fix ships in 10.0.7 alongside .NET SDK 10.0.107 and .NET runtime 10.0.7 in the out-of-band update on 2026-04-21. Self-contained deployments must be rebuilt against the patched library; framework-dependent deployments inherit the fix once the host runtime is patched.

Key-ring rotation is mandatory. Patching alone is insufficient: because the vulnerability lets attackers obtain payloads that are validly signed by the application''s current Data Protection key ring, every cookie or token forged before the patch will continue to be accepted by a patched server. Microsoft directs operators to (1) deploy the runtime/package patch, (2) revoke all keys in the active key ring via IKeyManager.RevokeAllKeys or the equivalent management UX, (3) generate a fresh key, (4) invalidate every active authentication session, and (5) audit logs for unexpected auth or anti-forgery validation events during the vulnerable window.

Exploitation status: Microsoft ranks exploitation as More Likely. As of 2026-04-27 there is no confirmed in-the-wild exploitation and no fully weaponized public proof-of-concept, but multiple detection vendors (CyCognito, SOC Prime) had published detection guidance within 24 hours of disclosure and the primitive is mechanically simple enough that public PoC release is expected within days.

Defenders must treat any internet-exposed ASP.NET Core 10 application as potentially compromised until both the package patch is deployed AND the data-protection key ring has been rotated. Partially-mitigated systems remain exposed to forged tokens issued during the vulnerable window. The blast radius is unusually broad because Microsoft.AspNetCore.DataProtection is shipped with the .NET 10 baseline rather than as an opt-in dependency, so virtually every ASP.NET Core 10 web application that uses cookie auth, anti-forgery protection, OpenID Connect, ASP.NET Core Identity, or any IDataProtector consumer is in scope.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1606 Forge Web Credentials
- T1606.001 Forge Web Credentials: Web Cookies
- T1068 Exploitation for Privilege Escalation
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1556 Modify Authentication Process
- T1550 Use Alternate Authentication Material
- T1505.003 Server Software Component: Web Shell
- T1098 Account Manipulation
- T1203 Exploitation for Client Execution

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Antiforgery Validation Failures Followed by Privileged Authentication — CVE-2026-40372 (SPL)** (`TL-2026-0427-SPL-002`)

Splunk correlation that detects a source IP producing antiforgery token deserialization / decryption failures and then successfully authenticating as an Administrator or admin-tagged role within the same 10-minute window — the post-exploitation handshake of a CVE-2026-40372 forged-token submission that escalates a session to a privileged identity.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1606.001, T1068, T1550.004, T1078
- **Data sources:** aspnetcore_application_logs, aspnetcore_authentication_logs, iis_aspnetcore_module
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=aspnetcore sourcetype="aspnetcore:stdout" "Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery" ("AntiforgeryValidationException" OR "An exception was thrown while deserializing the token" OR "The antiforgery token could not be decrypted") | bin _time span=10m | stats count AS af_failures, values(session_id) AS sessions BY _time, src_ip | where af_failures >= 5 | join type=inner src_ip [     search index=aspnetcore sourcetype="aspnetcore:stdout"     "Microsoft.AspNetCore.Authentication" "SignInAsync"     ("Administrator" OR "admin" OR role=*admin*) earliest=-10m     | stats latest(_time) AS auth_time, values(user) AS authenticated_user BY src_ip ] | eval cve="CVE-2026-40372", phase="post-exploitation" | table _time, src_ip, af_failures, sessions, auth_time, authenticated_user, cve, phase
```

### Microsoft KQL

```kql
let af = AppServiceConsoleLogs
    | where TimeGenerated > ago(1h)
    | where ResultDescription has "Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery"
    | where ResultDescription has_any ("AntiforgeryValidationException","An exception was thrown while deserializing the token","The antiforgery token could not be decrypted")
    | extend SourceIp = tostring(extract(@"(?:src_ip=|client=|RemoteIpAddress=)([0-9a-fA-F\.:]+)", 1, ResultDescription))
    | summarize AfFailures = count() by bin(TimeGenerated, 10m), SourceIp
    | where AfFailures >= 5;
let priv = SigninLogs
    | where TimeGenerated > ago(1h)
    | where ResultType == 0
    | where AppDisplayName has_any ("ASP.NET","aspnetcore") or ResourceDisplayName has "ASP.NET"
    | extend Roles = tostring(parse_json(tostring(AuthenticationDetails)).Roles)
    | where Roles has_any ("Administrator","admin");
af | join kind=inner priv on $left.SourceIp == $right.IPAddress
| project TimeGenerated, SourceIp, AfFailures, UserPrincipalName, Roles, AppDisplayName
```

### Sigma

```yaml
title: ASP.NET Core Antiforgery Failure Followed by Privileged Authentication (CVE-2026-40372)
id: 3e5f7a9b-0c1d-4e2f-8a3b-c403720004ee
status: experimental
description: |
    Antiforgery token deserialization or decryption failures from a single
    source IP that is then followed by a successful authentication into an
    Administrator or admin-tagged role within the same session window — a
    behaviour pattern consistent with CVE-2026-40372 forged-token submission
    (HMAC bypass in Microsoft.AspNetCore.DataProtection) leading to privilege
    elevation.
references:
    - https://github.com/dotnet/announcements/issues/395
    - https://socprime.com/blog/cve-2026-40372-detection/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/27
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1550.004
    - attack.t1606.001
    - attack.t1068
    - cve.2026.40372
logsource:
    product: aspnetcore
    category: application
detection:
    antiforgery_fail:
        Logger|contains: 'Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery'
        Message|contains:
            - 'An exception was thrown while deserializing the token'
            - 'AntiforgeryValidationException'
            - 'The antiforgery token could not be decrypted'
    privileged_auth:
        EventCategory: 'Authentication'
        Outcome: 'Success'
        Roles|contains:
            - 'Administrator'
            - 'admin'
    condition: antiforgery_fail and privileged_auth
fields:
    - SourceIp
    - SessionId
    - User
    - Roles
falsepositives:
    - Genuine antiforgery token expiry combined with admin re-authentication
    - Browser extensions that strip or rewrite cookies
level: high
```

**Known false positives:**

- Genuine antiforgery token expiry followed by admin re-authentication from the same IP
- Browser extensions or middleware that strip or rewrite anti-forgery cookies
- Bulk admin onboarding events where SSO and antiforgery cycle simultaneously

**Tuning notes:** Tune the af_failures>=5 threshold against the application's organic anti-forgery noise floor. Replace the role string match ('Administrator','admin') with the application's actual privileged role names (e.g., 'GlobalAdmin','tenant-owner','platform-engineer'). Consider widening the join window to 30 minutes for SPAs that lazy-load admin views well after sign-in.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- DataProtection Unprotect Failure Burst — CVE-2026-40372 Probing (KQL / Sentinel) (locked: unlock with TL Creds)
- IIS [indicator] Spawns Shell or LOLBin — CVE-2026-40372 Post-Forgery (KQL / Defender) (locked: unlock with TL Creds)
- ASP.NET Core Auth Cookie Source Mismatch — CVE-2026-40372 Forged Session Reuse (KQL) (locked: unlock with TL Creds)
- ASP.NET Core DataProtection Unprotect Failure Burst — CVE-2026-40372 (Sigma) (locked: unlock with TL Creds)
- IIS Worker [indicator] Spawns Shell or LOLBin Post-Authentication — CVE-2026-40372 (Sigma) (locked: unlock with TL Creds)
- Kestrel dotnet Host Spawns Unexpected Shell Children on Linux — CVE-2026-40372 (Sigma) (locked: unlock with TL Creds)
- DataProtection Unprotect Failure Burst — CVE-2026-40372 Probing (SPL) (locked: unlock with TL Creds)
- Outbound Network from IIS/dotnet Worker Post Forged-Cookie Activity — CVE-2026-40372 (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft Security Advisory CVE-2026-40372 — ASP.NET Core Elevation of Privilege (dotnet/announcements#395)](https://github.com/dotnet/announcements/issues/395)
- [ASP.NET Core repo issue #66410 — CVE-2026-40372](https://github.com/dotnet/aspnetcore/issues/66410)
- [GitLab Advisory Database — Microsoft.AspNetCore.DataProtection CVE-2026-40372](https://advisories.gitlab.com/nuget/microsoft.aspnetcore.dataprotection/CVE-2026-40372/)
- [Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug — The Hacker News](https://thehackernews.com/2026/04/microsoft-patches-critical-aspnet-core.html)
- [Microsoft releases emergency security updates for critical ASP.NET flaw — BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-security-updates-for-critical-aspnet-flaw/)
- [Emerging Threat: CVE-2026-40372 ASP.NET Core Privilege Escalation via Signature Bypass — CyCognito](https://www.cycognito.com/blog/emerging-threat-cve-2026-40372-asp-net-core-privilege-escalation-via-signature-bypass/)
- [CVE-2026-40372: ASP.NET Core Privilege Escalation Detection — SOC Prime](https://socprime.com/blog/cve-2026-40372-detection/)
- [Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw — Security Affairs](https://securityaffairs.com/191130/security/microsoft-out-of-band-updates-fixed-critical-asp-net-core-privilege-escalation-flaw.html)
- [ASP.NET Core Data Protection key management documentation](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/default-settings)
- [ASP.NET Core Data Protection key revocation guidance](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-management)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0427