Microsoft Rushes Patches for Critical ASP.NET Core Privilege Escalation Flaw

Microsoft has issued out-of-band updates to address a critical privilege escalation vulnerability (CVE-2026-40372) in ASP.NET Core’s Data Protection APIs. BleepingComputer reports that unauthenticated attackers could exploit this flaw by forging authentication cookies to gain SYSTEM privileges. The vulnerability stems from a regression in specific NuGet package versions where the cryptographic APIs incorrectly compute or discard HMAC validation tags, allowing forged or decrypted payloads.

This flaw enables attackers to bypass authenticity checks and potentially decrypt protected data like authentication cookies, antiforgery tokens, and OIDC state. While the vulnerability does not impact system availability, successful exploitation could allow an attacker to impersonate privileged users and issue their own legitimate tokens, such as session refresh or API keys. Microsoft advises that affected applications should rotate their Data Protection keys even after applying the patch to fully mitigate the risk.