Microsoft's Own Patch Tuesday Update Introduced a Critical ASP.NET Core Flaw, Forcing an Emergency 10.0.7 Release
A regression shipped in .NET 10.0.6 broke HMAC validation and exposed cookie-forging attacks. Microsoft released out-of-band .NET 10.0.7 on April 21 to patch CVE-2026-40372, rated 9.1 CVSS.
Overview
Microsoft shipped an emergency out-of-band update for ASP.NET Core on April 21, 2026, after discovering that its own routine Patch Tuesday release one week earlier had introduced a critical flaw in the framework’s cryptographic data protection layer. The vulnerability, tracked as CVE-2026-40372, could allow unauthenticated attackers to forge authentication cookies and escalate privileges on affected servers. According to the .NET Blog, the fix ships as .NET 10.0.7 and supersedes the broken 10.0.6 update.
The incident is notable less for its exploitation footprint — no in-the-wild abuse has been reported — than for its origin. The vulnerability is a regression introduced by the April 14 Patch Tuesday build itself, meaning administrators who diligently applied Microsoft’s most recent security update are the ones now running a critical flaw.
What We Know
The bug lives in the Microsoft.AspNetCore.DataProtection NuGet package, specifically in the managed authenticated encryptor that protects authentication cookies, antiforgery tokens, OIDC state, and TempData across ASP.NET Core applications. According to the .NET Blog, the encryptor “could compute its HMAC validation tag over the wrong bytes of the payload and then discard the computed hash” — a cryptographic failure that lets an attacker craft payloads that pass integrity checks without possessing the signing key.
BleepingComputer reported that the flaw permits “unauthenticated attackers to gain SYSTEM privileges on affected devices by forging authentication cookies,” and that attackers can additionally “decrypt previously-protected payloads in auth cookies, antiforgery tokens, TempData, OIDC state, etc.,” as stated in BleepingComputer’s coverage. The same report specifies that affected versions span 10.0.0 through 10.0.6 of the NuGet package, with 10.0.7 as the fixed release.
The vulnerability carries a CVSS score of 9.1, placing it in the critical tier, according to CSO Online. CSO also documents that the issue primarily affects Linux, macOS, and other non-Windows systems, as well as Windows systems where developers explicitly opted into managed cryptographic algorithms via the UseCustomCryptographicAlgorithms API. Projects targeting netstandard2.0 or net462 frameworks fall inside the affected surface.
Microsoft surfaced the problem after customers began reporting decryption failures following the 10.0.6 rollout, CSO Online reported, with a week passing between the April 14 introduction and the April 22 public disclosure alongside the 10.0.7 fix. The Hacker News characterized the underlying defect as a cryptographic failure in which “the encryptor calculated validation tags using incorrect payload bytes, then discarded the resulting hash,” compromising data integrity and enabling privilege escalation without triggering authentication alerts.
What the Patch Requires
Applying 10.0.7 is not a drop-in fix. According to the .NET Blog, administrators must install the SDK or runtime, confirm the version via dotnet --info, and then rebuild and redeploy affected applications — a sequence that matters for CI/CD pipelines and container workflows where binaries are baked into images.
Containerized deployments carry an additional burden. BleepingComputer’s guidance, echoed by multiple outlets, includes rotating the DataProtection key ring to invalidate any forged tokens that may have been issued during the vulnerable window, per BleepingComputer. The Hacker News similarly notes that updating the NuGet package alone is insufficient — applications must be redeployed and existing tokens invalidated, because tokens issued under the broken encryptor remain trusted until the key ring is cycled.
CSO Online adds that Docker images created after April 14 using unpatched .NET base images need to be rebuilt rather than patched in place, and recommends monitoring logs for “The payload was invalid” errors and unexpected authentication failures as proxies for either legitimate decryption breakage or malicious probing.
What We Don’t Know
No public indicator confirms active exploitation of CVE-2026-40372 in the wild. CSO Online reported that “no evidence of active exploitation exists” at the time of disclosure, though the outlet cautioned that the primitive — silently bypassing HMAC validation — is unusually dangerous because it leaves no authentication-error trail.
Microsoft has not publicly named a specific researcher or team as the discoverer. BleepingComputer reports that the investigation began after “user reports of decryption failures” following the 10.0.6 installation — suggesting the flaw was effectively self-disclosed through its side effects rather than reported through a coordinated security submission.
The scope of deployed applications running the broken 10.0.6 build has not been quantified publicly. ASP.NET Core is used across enterprise back offices, SaaS platforms, and government systems, and the one-week exposure window between April 14 and April 21 means any site that applied the monthly security update promptly is now the one carrying the risk.
Analysis
CVE-2026-40372 belongs to a small but growing category of vulnerabilities introduced by security updates themselves — cases where the mechanism meant to harden a platform introduces a sharper edge. As previously reported, PostgreSQL shipped its own out-of-cycle emergency release earlier this year after security patches broke core text functions and standby replication — a similar patch-induced regression event, though without the privilege-escalation consequences of the ASP.NET Core flaw.
The cryptographic shape of this specific bug is also worth noting. HMAC is the integrity backbone of ASP.NET Core’s DataProtection stack, and “computing the HMAC over the wrong bytes and discarding the hash” — the phrase Microsoft uses in its .NET Blog — is effectively a degradation to unauthenticated encryption. That is not a subtle CVSS-7 data exposure; it is the class of flaw that allows cookie forgery at scale against anything protected by the encryptor, which on a typical ASP.NET Core site includes the identity cookie, antiforgery tokens, and anything protected via the library’s APIs.
The operational takeaway is that rolling back from 10.0.6 to 10.0.5 is not an acceptable middle-ground response, since any tokens issued under 10.0.6 should now be considered potentially forgeable. The correct path, according to Microsoft’s guidance cited across BleepingComputer, The Hacker News, and the .NET Blog, is to move forward to 10.0.7, rebuild, redeploy, and rotate keys.