Microsoft Issues Emergency .NET 10.0.7 Update to Patch Elevation of Privilege Vulnerability

Gbhackers •Divya • April 22, 2026

Microsoft has issued an emergency out-of-band security update to address a severe vulnerability within the .NET framework. The critical release of .NET 10.0.7 patches an Elevation of Privilege flaw that inadvertently surfaced after a recent routine system update. Out-of-band patches bypass normal release schedules and indicate a pressing threat, meaning organizations relying on ASP.NET Core […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Issues Emergency Patches for Critical ASP.NET Core Vulnerability On April 21, 2026, Microsoft released an emergency out-of-band update, .NET 10.0.7, to address a critical privilege escalation vulnerability tracked as CVE-2026-40372. This flaw, found in the ASP.NET Core Data Protection cryptographic APIs, allows unauthenticated attackers to forge authentication cookies, potentially gaining SYSTEM privileges on affected devices. The vulnerability was discovered after users reported decryption failures following the installation of .NET 10.0.6 during Patch Tuesday. Microsoft has emphasized that all non-Windows operating systems using .NET 10.0.6 are impacted, and it is crucial for affected users to update to the latest version immediately. The flaw has a CVSS score of 9.1, indicating a severe risk of exploitation. Organizations are advised to rotate their DataProtection key rings to mitigate risks from previously issued tokens. This incident follows a previous critical vulnerability (CVE-2025-55315) patched in October 2025, highlighting ongoing security challenges in the ASP.NET framework. 16 sources 72

Microsoft Issues Emergency .NET 10.0.7 Update to Patch Elevation of Privilege Vulnerability

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)