Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw

Microsoft released out-of-band updates to fix a critical ASP.NET Core vulnerability (CVE-2026-40372, CVSS 9.1) in Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6 that allowed improper HMAC validation, enabling attackers to forge or decrypt protected data (cookies, antiforgery tokens) and potentially escalate to SYSTEM on non-Windows hosts; Microsoft patched the issue in ASP.NET Core 10.0.7 but warns that previously issued tokens remain valid unless the DataProtection key ring is rotated.