A CVSS 9.1 vulnerability in ASP.NET Core Data Protection went unnoticed in production for six patch versions. Here is what happened and what it means for your update strategy.
What Went Wrong
CVE-2026-40372 affected the Microsoft.AspNetCore.DataProtection package in versions 10.0.0 through 10.0.6. The managed authenticated encryptor was computing its HMAC validation tag over the wrong bytes and then discarding the hash entirely. That meant forged authentication cookies could escalate to SYSTEM privileges on affected servers.
Microsoft shipped an out-of-band fix in 10.0.7 after users reported decryption failures post-update. The irony: broken decryption was actually the symptom that surfaced a far worse underlying flaw.
Immediate Action Items
- Update Microsoft.AspNetCore.DataProtection to 10.0.7 or later immediately.
- Rotate your DataProtection key ring if your app was internet-facing during the vulnerable window.
- Audit any tokens issued during that period, as they may have been forged.
Takeaway
Patching alone is not enough. If your pipeline does not validate cryptographic behavior after updates, silent regressions like this one slip through. Automated integration tests that verify auth token round-trips would have caught this before production. Build post-patch validation into your CI/CD process to catch what unit tests miss.
