Microsoft Releases Urgent Update for ASP.NET Vulnerability on macOS and Linux

Microsoft has announced an urgent update to address a significant security flaw in ASP.NET Core that poses a risk to users on macOS and Linux platforms. The vulnerability, identified as CVE-2026-40372, impacts versions 10.0.0 to 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package, which is integral to the framework. This flaw arises from inadequate verification of cryptographic signatures, enabling unauthorized attackers to create forged authentication payloads during the HMAC validation process. Such exploitation could grant these attackers SYSTEM privileges, leading to a complete takeover of affected devices. Users who operated on vulnerable versions are particularly at risk, as any authentication credentials generated by malicious actors may persist even after the patch is applied. Therefore, it is crucial for users to ensure that any compromised credentials are removed to safeguard their systems.