Vulnerability

CERT-In Vulnerability Note CIVN-2026-0217
Privilege Escalation Vulnerability in Microsoft ASP.NET Core

Original Issue Date:May 06, 2026

Severity Rating: CRITICAL

Software Affected

ASP.NET Core versions prior to 10.0.7

Overview

A vulnerability has been reported in ASP.NET Core, which could allow a remote attacker to gain elevated privileges on the targeted system.

Target Audience:
All end user organizations and individuals using application built on ASP.NET Core.

Risk Assessment:
High risk of Privilege escalation.

Impact Assessment:
Potential for sensitive data exposure, forging of authentication cookies or tokens.

Description

ASP.NET Core is a modern, high-performance, open-source framework developed by Microsoft for building cloud-based, internet-connected applications.

This vulnerability exists in Microsoft ASP.NET Core due to improper verification of cryptographic signatures in the data protection mechanism. A remote attacker could exploit this vulnerability by tampering with or forging ASP.NET Core Data Protection tokens.

Successful exploitation of this vulnerability could allow the attacker to gain elevated privileges on the targeted system.

Solution

Apply appropriate fix/patches as mentioned:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372

Vendor Information

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372

References

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372

CVE Name
CVE-2026-40372

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India