Microsoft Issues Emergency Patch for ASP.NET Core Vulnerability Allowing SYSTEM Privilege Escalation on macOS and Linux

Microsoft has issued an emergency patch for a critical vulnerability in its ASP.NET Core framework, which could allow unauthenticated attackers to gain SYSTEM privileges on devices running Linux or macOS applications built with the framework.

The software giant disclosed the flaw on Tuesday evening, warning that the vulnerability, tracked as CVE-2026-40372, impacts versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package—a core component of ASP.NET Core used for data protection and cryptographic operations.

How the Vulnerability Works

The flaw stems from a faulty verification of cryptographic signatures, enabling attackers to forge authentication payloads during the HMAC validation process. This process is critical for verifying the integrity and authenticity of data exchanged between a client and a server. By exploiting this weakness, unauthenticated threat actors could bypass security controls and inject malicious payloads to escalate privileges.

Risks and Persistent Threats

Devices running vulnerable versions of the package were exposed to attacks that allowed unauthenticated individuals to gain SYSTEM-level access, compromising the entire underlying machine. Even after applying the patch, organizations must remain vigilant. Forged credentials created by attackers during the vulnerability window may persist post-patching, necessitating a thorough review and cleanup of authentication tokens and sessions.

Immediate Actions for Users

• Update immediately: Install the latest patched version of the Microsoft.AspNetCore.DataProtection NuGet package (version 10.0.7 or later).
• Audit credentials: Review and revoke any authentication tokens or sessions that may have been compromised during the vulnerability window.
• Monitor systems: Implement enhanced monitoring to detect any signs of exploitation or unauthorized access.

Microsoft has not reported any active exploitation of this vulnerability in the wild as of the time of disclosure. However, given the severity of the flaw, users are strongly advised to apply the patch without delay to mitigate potential risks.