tldrdailynews.com logo

Microsoft patches critical ASP.NET Core data-protection flaw to curb cookie forgery

1 min read
Source: BleepingComputer
Microsoft patches critical ASP.NET Core data-protection flaw to curb cookie forgery
Photo: BleepingComputer
TL;DR

Microsoft released out-of-band security updates for a critical ASP.NET Core Data Protection vulnerability (CVE-2026-40372) that could let unauthenticated attackers forge authentication cookies and gain SYSTEM privileges. The flaw comes from a regression in the 10.0.0–10.0.6 NuGet packages, which could cause forged payloads to bypass authenticity checks; upgrading to 10.0.7 and redeploying with a rotated DataProtection key ring fixes the issue. This follows April’s Patch Tuesday and includes additional out-of-band Windows Server fixes. No service disruption is reported, but applications using DataProtection should update promptly to prevent token forgery and data exposure.

Topics:technologysecurity#aspnet-core#cve-2026-40372#data-protection#out-of-band#patch-management#security
Share this article
  1. Microsoft releases emergency patches for critical ASP.NET flaw  BleepingComputer
  2. Microsoft issues emergency update for macOS and Linux ASP.NET threat  Ars Technica
  3. Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug  The Hacker News
  4. Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core  csoonline.com
  5. Microsoft releases emergency out-of-band .NET update to patch severe bug  Neowin

Want the full story? Read the original reporting

Read on BleepingComputer