Loading story…
Microsoft released an out-of-band update for Microsoft.AspNetCore.DataProtection 10.0.7 to fix CVE-2026-40372, a critical ASP.NET Core elevation-of-privilege flaw caused by improper verification of cryptographic signatures (CWE-347). The regression affects package versions 10.0.0 through 10.0.6 and was uncovered while Microsoft investigated customer-reported decryption failures after the .NET 10.0.6 Patch Tuesday release. Microsoft said the bug in the managed authenticated encryptor could let unauthenticated attackers bypass HMAC validation, forge authentication cookies and other protected payloads, decrypt some protected data, and potentially authenticate as privileged users.
The vulnerability primarily affects applications running the vulnerable NuGet package at runtime on Linux, macOS, and other non-Windows systems, with some net462 and netstandard2.0 consumers also exposed; Microsoft said Windows deployments and the 8.0.x and 9.0.x branches are not affected under the described conditions. Because ASP.NET Core Data Protection is widely used for cookies, tokens, anti-forgery protections, TempData, and similar application state, successful exploitation can enable file disclosure and data modification without impacting availability. Microsoft urged organizations to upgrade to 10.0.7, rebuild and redeploy affected applications, rotate the DataProtection key ring, and audit long-lived tokens, API keys, password reset links, and logs because legitimately signed artifacts issued during exploitation may remain valid after patching.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On April 21, 2026, Microsoft released the out-of-band .NET 10.0.7 and Microsoft.AspNetCore.DataProtection 10.0.7 update to fix CVE-2026-40372. Customers were urged to upgrade immediately, rebuild and redeploy affected applications, and verify runtime versions after installation.
Public reporting described how an unauthenticated attacker could tamper with a DataProtection payload, replace the final 32-byte HMAC with null bytes, and exploit flawed MAC validation to decrypt modified claims. The technique could produce forged principals and enable elevated or administrative access.
Microsoft's advisory identified the issue as CWE-347 with CVSS 8.1, noted that Linux, macOS, and some net462/netstandard2.0 consumers were primarily affected, and said Windows deployments and 8.0.x/9.0.x branches were not affected under the described conditions. It recommended upgrading to 10.0.7 or later, rotating the DataProtection key ring, and auditing long-lived tokens and logs for abuse.
On April 21, 2026, Microsoft disclosed CVE-2026-40372, an ASP.NET Core elevation of privilege vulnerability affecting Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6. Microsoft said the flaw could let attackers forge authentication cookies, decrypt some protected payloads, and gain privileged access in affected deployments.
Microsoft began investigating customer-reported decryption failures that appeared after installation of the .NET 10.0.6 Patch Tuesday update. The investigation led to discovery of a regression in ASP.NET Core Data Protection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesocprime.com
Open sourcearstechnica.com
Open sourcecyber.gc.ca
Open sourcemsrc.microsoft.com
Open sourcecvereports.com
Open sourcegithub.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for elevation of privilege vulnerabilities affecting **ASP.NET** and **.NET**, including `CVE-2023-36899` and `CVE-2026-35433`. The newer flaw, `CVE-2026-35433`, affects .NET and stems from improper input validation combined with an integer overflow or wraparound condition that can let an unauthorized attacker elevate privileges locally if a user triggers the malicious payload in an application. Microsoft rated `CVE-2026-35433` as **Important** with a **CVSS 3.1 score of 7.3** and said successful exploitation could result in **SYSTEM** privileges. The company reported that the issue was neither publicly disclosed nor known to be exploited at publication time, assessed exploitation as unlikely, and said fixes were made available through **.NET Framework** updates, while the ASP.NET issue `CVE-2023-36899` was also listed in Microsoft's Security Update Guide as an elevation of privilege vulnerability.
Jun 29, 2026
Microsoft published security advisories for two **Important** remote **denial-of-service (DoS)** vulnerabilities affecting **.NET** and **ASP.NET Core**: **CVE-2026-26127** and **CVE-2026-26130**. Both issues are scored **CVSS 3.1 7.5** with `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, indicating network-reachable exploitation with low complexity, no privileges, and no user interaction, resulting in high availability impact. CVE-2026-26127 is described as a **.NET DoS** condition associated with **CWE-125 (Out-of-bounds Read)**, while CVE-2026-26130 is an **ASP.NET Core DoS** issue associated with **CWE-770 (Allocation of Resources Without Limits or Throttling)**. Organizations running internet-exposed or high-availability services on these frameworks should prioritize applying Microsoft’s updates and review service-level protections (e.g., request throttling and resource limits) where applicable to reduce DoS risk.
Jun 29, 2026
Microsoft published security updates for a series of Windows elevation-of-privilege vulnerabilities affecting components including **Core Messaging**, **CSC Service**, **Cryptographic Services**, **Win32k**, and the **COM+ Event System Service**. The referenced flaws include `CVE-2025-21378`, `CVE-2025-21184`, `CVE-2025-21414`, `CVE-2025-26634`, `CVE-2025-49727`, `CVE-2025-58725`, and `CVE-2025-62458`, indicating a broad set of local privilege-escalation issues across core Windows subsystems. Among them, Microsoft provided additional detail for `CVE-2026-40377`, an **Important** vulnerability in Microsoft Cryptographic Services caused by a heap-based buffer overflow. Microsoft said a locally authorized attacker with low privileges could exploit the flaw to gain **SYSTEM** privileges without user interaction; the issue received a **CVSS 3.1 score of 7.8**, was assessed as **less likely** to be exploited, and was **not publicly disclosed or exploited** at the time of publication. Microsoft said a fix was available and credited **Bruce Dang of Calif.io** for reporting the bug.
Jul 12, 2026