Microsoft has issued an urgent patch for its ASP.NET Core, targeting a severe vulnerability that could let unauthorised users gain full control of machines running Linux or macOS apps. The flaw, tracked as CVE-2026-40372, lies in the cryptographic signatures verification mechanism within the Microsoft.AspNetCore.DataProtection NuGet package.

According to Microsoft, hackers can exploit this to create forged authentication tokens that remain valid even after patching. To mitigate risks, users must clear any potentially compromised credentials post-upgrade. The company notes its ASP.NET Core framework is built for high-performance web development across multiple operating systems, highlighting the importance of keeping it up-to-date.

The vulnerability's severity underscores the need for continuous security measures and regular updates in software ecosystems, especially when they involve sensitive operations like authentication. For developers using affected versions, the advice is clear: patch immediately but don't stop there – ensure all session tokens are invalidated to avoid lingering threats.