Microsoft Secures ASP.NET Core Vulnerability

Microsoft issued an out-of-band security update on Tuesday evening for its ASP.NET Core framework to address a high-severity vulnerability tracked as CVE-2026-40372. The company said the issue could allow an unauthenticated attacker to obtain SYSTEM-level privileges on devices running Linux or macOS applications that use the affected components.

The vulnerability impacts versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package. Microsoft said applying the update by moving to version 10.0.7 resolves the immediate software flaw.

According to Microsoft’s description, the root cause was an error in how cryptographic signatures were verified. The weakness involved faulty validation during the HMAC checking process, which Microsoft said could enable an attacker to fabricate authentication payloads. If exploited, the company said this could result in unauthorized access and a complete compromise of the underlying machine.

Microsoft assigned the vulnerability a maximum severity score of 9.1 out of 10. The company’s guidance emphasized that patching alone may not fully address the risk if malicious credentials were created while systems were exposed.

Alongside upgrading to 10.0.7, Microsoft advised customers to rotate their DataProtection key ring. The company said this step matters because any forged authentication credentials produced by threat actors during the vulnerable period could remain valid, potentially allowing continued unauthorized access even after the software update is installed.

Microsoft also recommended auditing application-level long-lived artifacts for signs of compromise. The company did not provide additional details in the advisory about specific incidents, but its guidance indicates a focus on identifying persistence mechanisms that could survive routine patching.

For global markets, the update is relevant to organizations running ASP.NET Core workloads across Linux and macOS environments, including cross-border software teams that rely on NuGet packages for application delivery. Security updates that require both patching and key rotation can also increase operational workload for enterprises, particularly those with distributed deployments and compliance obligations across multiple jurisdictions.