CVE-2026-40372: Critical ASP.NET Core Privilege Escalation on Linux — Patch to .NET 10.0.7 Now

Microsoft issued an emergency out-of-band security update on April 21, 2026, releasing .NET 10.0.7 to patch CVE-2026-40372 — a critical privilege escalation vulnerability in the ASP.NET Core DataProtection subsystem. CVSS score: 9.1. No authentication required. Attack vector: network.

If you run ASP.NET Core web apps on Linux, patch now.

What the vulnerability does

The flaw lives in Microsoft.AspNetCore.DataProtection, versions 10.0.0 through 10.0.6. It stems from improper cryptographic signature verification in how the DataProtection subsystem validates execution context on Linux. An unauthenticated remote attacker can send crafted requests that exploit differences between the Linux and Windows runtime environments, allowing them to escalate their privileges on the affected host.

On a shared hosting environment or containerized deployment, that means an attacker with no credentials can potentially move laterally from application space to broader system access. DataProtection underpins session management, cookie protection, and anti-forgery tokens in ASP.NET Core — the attack surface is wide.

Affected versions

• Microsoft.AspNetCore.DataProtection 10.0.0 – 10.0.6
• Platforms: Linux only — Windows and macOS are not affected
• .NET 9 and earlier are not affected

Fix

Upgrade to .NET 10.0.7. This is an emergency out-of-band release, not a regular Patch Tuesday update — it will not appear in your usual monthly cadence. You need to pull it explicitly.

# Update the .NET SDK
dotnet sdk update

# Or update runtime directly
dotnet tool update --global dotnet-sdk

# Verify installed version
dotnet --version

For Docker-based deployments, pull the updated base image:

FROM mcr.microsoft.com/dotnet/aspnet:10.0.7

Package references in your project file should be pinned or verified:

<PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />

Audit your DataProtection configuration

Beyond patching, Microsoft recommends auditing your DataProtection key storage configuration. Ensure keys are stored in a location with restricted filesystem permissions, and that key ring access is limited to the application’s service account only. Keys stored in writable directories with loose permissions compound the risk.

Why the emergency release

Microsoft issued this outside the monthly patch cycle, which indicates active exploitation is either confirmed or considered imminent. The Linux-specific nature of the flaw suggests it may have been discovered through differential fuzzing between platform implementations — a technique that’s found several recent .NET vulnerabilities.

Security teams running .NET microservices or API backends on Linux Kubernetes clusters should treat this as P0. The combination of no-auth requirement and network attack vector makes this straightforwardly dangerous.

Check your NuGet lock files, bump the version, rebuild, and redeploy today.