Microsoft issues emergency update for macOS and Linux ASP.NET threat

Microsoft has taken swift action by releasing an emergency patch for its ASP.NET Core framework, addressing a significant vulnerability that could allow unauthorized attackers to obtain SYSTEM privileges on devices running Linux or macOS applications. The company announced this critical update on Tuesday evening, highlighting that the flaw, identified as CVE-2026-40372, impacts versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtectionNuGet package, which is integral to the framework. The root of this serious issue lies in an improper verification of cryptographic signatures. This weakness can be exploited by attackers to forge authentication payloads during the HMAC validation process, which is essential for ensuring the integrity and authenticity of data exchanged between clients and servers. Users who operated on vulnerable versions of the package were at risk of an attack, enabling unauthorized individuals to gain access to sensitive SYSTEM privileges and potentially compromise their machines completely. Even with the vulnerability now patched, there remains a risk for devices that might still be compromised if any authentication credentials generated by malicious actors are not removed. Microsoft elaborated, stating, "If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens (session refresh, API key, password reset link, etc.) to themselves." These tokens will continue to be valid post-upgrade to version 10.0.7 unless the DataProtection key ring is rotated. ASP.NET Core is recognized by Microsoft as a high-performance web development framework designed for building .NET applications across Windows, macOS, Linux, and Docker environments. As an open-source solution, it aims to facilitate rapid evolution of runtime components, APIs, compilers, and languages while providing a stable platform for applications to function effectively.