Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

Microsoft disclosed CVE-2026-40372, a high-severity (CVSS 9.1) vulnerability in Microsoft.AspNetCore.DataProtection (NuGet 10.0.0–10.0.6) where an HMAC validation regression allowed forged payloads to pass authenticity checks, potentially enabling privilege escalation to SYSTEM on non-Windows hosts. Microsoft released fixes in ASP.NET Core 10.0.7 and warned that previously issued tokens remain valid unless the DataProtection key ring is rotated.