Microsoft issues emergency update for macOS and Linux ASP.NET threat

Microsoft has issued an emergency update for its ASP.NET Core to address a critical vulnerability (CVE-2026-40372) affecting versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package on macOS and Linux. The flaw allows unauthenticated attackers to gain SYSTEM privileges by forging authentication payloads during the HMAC validation process. Even after patching, devices may still be at risk if forged credentials created by threat actors are not removed. ASP.NET Core is a high-performance web development framework for creating .Net apps on various platforms, including Windows, macOS, Linux, and Docker.