Microsoft has released an out-of-band .NET 10.0.7 update to fix a critical ASP.NET Core Data Protection vulnerability (CVE-2026-40372) that could let unauthenticated attackers gain SYSTEM privileges ...
Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired. Developers are advised to check their applications after Microsoft ...