
Microsoft Releases Urgent Patch for ASP.NET Core Privilege Escalation (CVE-2026-40372)
Microsoft issued out-of-band updates to fix a critical ASP.NET Core vulnerability (CVE-2026-40372) that could let an attacker escalate to SYSTEM by forging tokens when a vulnerable DataProtection NuGet package (Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6) is loaded at runtime on non-Windows systems. The fix is in ASP.NET Core 10.0.7; exploitation requires the vulnerable package, a non-Windows OS, and the app running with the library loaded. If tokens were issued during the vulnerability window, they remain valid after upgrading until the DataProtection key ring is rotated.



