CVE-2026-40372criticalCWE-347

CVE-2026-40372: critical vulnerability in Microsoft ASP.NET Core 10.0

ASP.NET Core Elevation of Privilege Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Visual Studio+ Monitor ASP.NET Core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 11%
In short

ASP.NET Core doesn't properly verify digital signatures, allowing attackers to forge authentication credentials and gain unauthorized access to systems over the network.

Technical detail

The vulnerability stems from improper cryptographic signature verification in ASP.NET Core's authentication mechanism (CWE-347), enabling remote attackers to bypass signature validation and escalate privileges without prior authentication. This affects network-accessible ASP.NET Core applications and could lead to complete system compromise.

Summary generated and translated by AI from the official description.
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · ASP.NET Core 10.0Microsoft · Microsoft Visual Studio 2026 version 18.5
Related CVEs — Microsoft ASP.NET Core 10.0

In the same product, most dangerous first.

CVE-2026-26130HIGHASP.NET Core Denial of Service VulnerabilityEPSS 3.0%CVE-2026-45591HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.5%CVE-2026-70181HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.2%CVE-2026-96236HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.1%CVE-2026-70186HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.0%CVE-2026-70188CRITICALASP.NET Core Security Feature Bypass VulnerabilityEPSS 0.9%