Microsoft released an emergency patch for ASP.NET Core fixing a critical unauthenticated SYSTEM privilege escalation vulnerability affecting Linux and macOS deployments.
Microsoft issued an out-of-band emergency patch for CVE-2026-40372, a high-severity vulnerability in Microsoft.AspNetCore.DataProtection NuGet package versions 10.0.0–10.0.6. The flaw stems from faulty HMAC cryptographic signature verification, allowing unauthenticated attackers to forge authentication payloads and escalate to SYSTEM-level privileges on Linux and macOS. Version 10.0.7 patches the vulnerability, but Microsoft warns that attacker-forged tokens issued during the vulnerable window remain valid unless the DataProtection key ring is manually rotated.
Any ASP.NET Core app on Linux or macOS running DataProtection package versions 10.0.0–10.0.6 is fully compromised if hit. The HMAC validation flaw lets attackers forge auth payloads and elevate to SYSTEM without credentials. Critically, patching to 10.0.7 alone isn't enough — any tokens issued during the vulnerable window are still live and valid until you rotate your DataProtection key ring.
Run `dotnet list package --vulnerable` in your project directory today to confirm your DataProtection version, then upgrade to 10.0.7 and rotate your DataProtection key ring to invalidate any attacker-forged tokens.
Open your terminal and navigate to your ASP.NET Core project root
Tags