9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40372

CVE-2026-40372: ASP.NET Core Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40372

CVE-2026-40372:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Microsoft.AspNetCore.DataProtection	nuget	>= 10.0.0, <= 10.0.6	10.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

An elevation of privilege vulnerability exists in Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6. The vulnerability allows an attacker to forge authentication cookies and decrypt some protected payloads. This is due to improper verification of cryptographic signatures, specifically a padding oracle vulnerability.

The vulnerability was introduced during the development of version 10.0 and is present in the managed authenticated encryptor code path, which is used on non-Windows operating systems, and also on Windows when not using the net10.0 target framework. The patched version, 10.0.7, corrects the validation routine to reject payloads with all-zero HMAC bytes.

The vulnerable function is Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.Decrypt, which is responsible for decrypting and validating the protected payload. During exploitation, this function would appear in a runtime profile or stack trace.

To mitigate this vulnerability, users should upgrade to Microsoft.AspNetCore.DataProtection version 10.0.7 or later. Additionally, it is recommended to rotate the DataProtection key ring to invalidate any tokens that may have been illegitimately issued.

Vulnerable functions

Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.Decrypt

src/DataProtection/Managed/src/ManagedAuthenticatedEncryptor.cs

This function is responsible for decrypting and validating protected payloads. The vulnerability lies in the fact that it improperly verifies the cryptographic signature (HMAC), allowing an attacker to forge payloads. An attacker can exploit this by sending a specially crafted payload with an all-zero HMAC, which the vulnerable function would accept, leading to elevation of privilege.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.