Microsoft Releases Emergency .NET 10.0.7 Update to Fix Critical Privilege Escalation Flaw

Microsoft has released an emergency out-of-band update, .NET 10.0.7, to address a critical Elevation of Privilege (EoP) vulnerability that could allow attackers to tamper with protected data and gain unauthorized access.

The urgent patch highlights the severity of the issue, as out-of-band releases are reserved for actively exploitable or high-risk flaws requiring immediate attention.

Vulnerability Overview

The flaw, tracked as CVE-2026-40372, was introduced as a regression during the .NET 10.0.6 Patch Tuesday update.

Initially reported as application-level decryption failures, further investigation by Microsoft engineers revealed a deeper cryptographic issue within the ASP.NET Core Data Protection framework.

The root cause lies in Microsoft.AspNetCore.DataProtection NuGet package. Specifically, the managed authenticated encryptor incorrectly handled its Hash-based Message Authentication Code (HMAC).

Instead of validating the correct payload, the system calculated the authentication tag using incorrect byte sequences and discarded the resulting hash.

This failure breaches data integrity guarantees, allowing attackers to manipulate protected payloads without triggering authentication checks.

In real-world scenarios, this could enable privilege escalation, allowing unauthorized users to gain higher-level system access.

The vulnerability impacts:

• Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6
• Applications built on .NET 10 using ASP.NET Core Data Protection
• Containerized workloads running vulnerable .NET base images

Organizations relying on these components, especially in cloud-native or microservices environments, face elevated risk if patches are not applied promptly.

Because ASP.NET Core Data Protection is widely used to secure sensitive data such as authentication tokens, cookies, and session state, this vulnerability poses a serious threat.

Attackers exploiting this flaw could bypass integrity checks, manipulate encrypted data, and escalate privileges without detection.

The issue is particularly dangerous in distributed systems where encrypted payloads are trusted across services.

Mitigation and Remediation

Microsoft urges organizations to take immediate action:

• Download and install the .NET 10.0.7 SDK or runtime from the official Microsoft source
• Verify the installed version using the command: dotnet –info
• Update Microsoft.AspNetCore.DataProtection dependencies to version 10.0.7 in all projects
• Rebuild applications to ensure secure cryptographic libraries are properly integrated
• Redeploy updated applications using fresh builds or container images

Simply patching the runtime is not sufficient; applications must be recompiled and redeployed to mitigate the risk fully.

Microsoft has encouraged developers to report any anomalies encountered during the update process through its .NET feedback channels.

The company is actively monitoring the situation to ensure stability and prevent similar cryptographic regressions in future releases.

Security teams should prioritize this patch as part of their incident response and vulnerability management workflows, ensuring all affected systems are updated without delay.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google