CVE-2026-40372: 
C# vulnerability analysis and mitigation

CVE-2026-40372 is a critical elevation of privilege vulnerability in ASP.NET Core caused by improper verification of cryptographic signatures in the Microsoft.AspNetCore.DataProtection package. It allows an unauthenticated remote attacker to forge authentication cookies and decrypt protected payloads, effectively escalating privileges over a network without any user interaction. The vulnerability affects ASP.NET Core 10.0 versions 10.0.0 through 10.0.6, and was disclosed on April 21, 2026, with a patch released the same day as an out-of-band emergency update. It carries a CVSS v3.1 base score of 9.1 (Critical) (MSRC, GitHub Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). A defect introduced during .NET 10.0 development in the Microsoft.AspNetCore.DataProtection package causes the HMAC validation routine to accept forged payloads — specifically, payloads carrying all-zero HMAC bytes — as valid. This flaw is primarily exploitable on Linux and macOS (non-Windows) when the application loads the affected NuGet binary at runtime (i.e., it does not rely on the correct shared framework copy), or on any OS when the net462/netstandard2.0 target framework asset is consumed. The attack is analogous to MS10-070, which exploited a padding-oracle condition in ASP.NET's legacy encryption infrastructure, and is mapped to CAPEC-463 (Padding Oracle Crypto Attack) and CAPEC-475 (Signature Spoofing by Improper Validation) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated attacker to forge authentication cookies and potentially decrypt protected payloads, resulting in complete compromise of confidentiality and integrity with no availability impact. An attacker who authenticates as a privileged user during the vulnerable window may cause the application to issue legitimately-signed long-lived tokens — such as session refresh tokens, API keys, and password reset links — that remain valid even after patching unless the DataProtection key ring is rotated. Additionally, secrets stored inside IDataProtector.Protect output (e.g., database connection strings, third-party API keys) may be exposed (GitHub Advisory, MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.039% (0.000390), indicating a low near-term exploitation probability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the high CVSS score (9.1), network accessibility, and zero authentication requirement make it a high-priority patching target (Feedly).

1. Reconnaissance: Identify internet-exposed ASP.NET Core 10.0 applications running on Linux or macOS that use Microsoft.AspNetCore.DataProtection versions 10.0.0–10.0.6 (e.g., via HTTP response headers, error pages, or framework fingerprinting tools).
2. Confirm vulnerability: Verify the application loads the affected NuGet binary at runtime — this occurs when the app does not use the Microsoft.NET.Sdk.Web SDK or lacks a Microsoft.AspNetCore.App framework reference, or when targeting net462/netstandard2.0.
3. Craft forged payload: Construct a malicious authentication cookie or protected payload with all-zero HMAC bytes, exploiting the broken HMAC validation routine that accepts such payloads as valid.
4. Submit forged authentication cookie: Send the crafted cookie to an authenticated endpoint. The vulnerable DataProtection code accepts the forged payload, granting the attacker access as an arbitrary (potentially privileged) user.
5. Obtain legitimately-signed tokens: Once authenticated as a privileged user, trigger application flows that issue long-lived tokens (API keys, password reset links, refresh tokens), which remain valid even after the application is patched unless the key ring is rotated.
6. Optional — decrypt protected payloads: Use a padding-oracle-style attack (requiring high request volume against endpoints accepting protected payloads) to recover plaintext from protected data, potentially exposing stored secrets (GitHub Advisory).

• Network: Sustained high-volume HTTP requests with varying cookie or query-parameter values targeting a single authenticated endpoint — orders of magnitude above normal traffic — which is characteristic of a padding-oracle attack requiring many requests per byte recovered.
• Logs: Web server access logs showing anomalous request volume against endpoints that accept protected payloads (authentication cookies, antiforgery tokens, state parameters) during the vulnerable window (when Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6 was deployed).
• Application Behavior: Unexpected privilege escalation events or authenticated sessions for accounts that should not have been active; issuance of long-lived tokens (API keys, password reset links) to unrecognized or suspicious users during the vulnerable window.
• File System / Configuration: Presence of Microsoft.AspNetCore.DataProtection NuGet package versions 10.0.0–10.0.6 in application dependency manifests on Linux or macOS hosts (GitHub Advisory).

The primary remediation is to upgrade Microsoft.AspNetCore.DataProtection to version 10.0.7 or later and redeploy the application; this corrects the HMAC validation routine and causes forged payloads (identifiable by all-zero HMAC bytes) to be rejected (MSRC, GitHub Advisory). After upgrading, organizations should rotate the DataProtection key ring using IKeyManager.RevokeAllKeys() to invalidate any legitimately-signed tokens that may have been issued to attackers during the vulnerable window. Additionally, audit and rotate any long-lived application-layer artifacts (API keys, refresh tokens, password reset links) issued during the vulnerable period, and rotate secrets stored inside IDataProtector.Protect output. As a temporary measure if immediate patching is not feasible, restrict network access to affected ASP.NET Core 10.0 applications (GitHub Advisory, Microsoft .NET Blog).

Microsoft released an emergency out-of-band patch on April 21, 2026, which generated significant coverage across security media outlets including BleepingComputer, The Hacker News, Ars Technica, CSO Online, and Security Affairs (BleepingComputer, The Hacker News). Duende Software published specific update guidance for IdentityServer users affected by the flaw, noting the DataProtection dependency impact (Duende Software). Community discussion on Reddit, Mastodon, Bluesky, and security forums highlighted the severity and the nuanced affected configurations (Linux/macOS only for the primary path), with some commentary noting the similarity to the historic MS10-070 padding oracle vulnerability. The Canadian Centre for Cyber Security (CCCS) and HKCERT also issued advisories urging immediate patching (CCCS).