Emergency .NET Update: Critical Data Protection Flaw Allows Authentication Forgery

Microsoft issued an out-of-band patch (10.0.7) for CVE-2026-40372, a critical vulnerability in Microsoft.AspNetCore.DataProtection used by ASP.NET Core on .NET 10 (non-Windows) that allows attackers to forge authentication cookies, gain privileged access, and potentially decrypt protected data; recommended remediation is immediate upgrade, DataProtection key-ring rotation to invalidate tokens, and auditing of logs and long-lived artifacts.