Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Microsoft issued an out-of-band patch for a critical CVE-2026-40372 (9.1 severity) regression introduced in the April 14 .NET 10.0.6 update. A bug in the ManagedAuthenticatedEncryptor causes incorrect offset calculation for the validation tag in the Data Protection Library's Hash-based Message Authentication Code (HMACs), allowing attackers to forge payloads that pass authenticity checks and decrypt protected auth cookies, anti-forgery tokens, and more. The flaw affects Linux, macOS, and Windows systems using custom cryptographic algorithms. Simply applying the 10.0.7 runtime update is not enough — developers must also rebuild any ASP.NET Core applications built after April 14, expire all affected authentication cookies and tokens, and rotate Data Protection keys. Docker-based projects are particularly impacted since the library is embedded in built applications.

Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core