PT-2026-34051 · Microsoft+2 · Asp.Net Core+2

Published 2026-04-21 · Updated 2026-06-04 · CVE-2026-40372

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 Visual Studios 2026 version 18.5

Description Improper verification of cryptographic signatures in the Microsoft.AspNetCore.DataProtection library allows an unauthorized remote attacker to elevate privileges over a network. This issue enables the forgery of authentication cookies and the decryption of certain protected payloads, potentially granting the attacker SYSTEM-level access. Real-world incidents have been reported where attackers forged authentication tokens to escalate to administrator privileges and subsequently performed lateral movement. The flaw is particularly impactful on non-Windows operating systems, such as Linux and macOS, and can be exploited via a padding-oracle condition, which requires a high volume of requests against endpoints that accept protected payloads, such as authentication cookies, antiforgery tokens, or state parameters.

Recommendations Upgrade Microsoft.AspNetCore.DataProtection to version 10.0.7 or later and redeploy the application. Rotate the DataProtection key ring to invalidate any legitimately-signed tokens issued to attackers during the vulnerable window. Audit application-level long-lived artifacts created during the vulnerable window, such as API keys, refresh tokens, access tokens, password reset links, or email-confirmation tokens, and rotate them at the application layer. Rotate any long-lived secrets, such as database connection strings or third-party API keys, that were stored in plaintext inside IDataProtector.Protect output. Review web server logs for anomalous high-volume traffic against endpoints accepting protected payloads to identify potential exploitation attempts.

Fix

LPE

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2026-05725

BIT-ASPNET-CORE-2026-40372

CVE-2026-40372

GHSA-9MV3-2CWR-P262

USN-8215-1

USN-8216-1

Affected Products

Asp.Net Core

Linuxmint

Ubuntu

References · 101

• https://osv.dev/vulnerability/GHSA-9mv3-2cwr-p262 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32203 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33116 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40372 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-aspnet-core-2026-40372 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8216-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40372 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40372 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8215-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32178 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8216-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8215-1 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40372 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05725 · Security Note