CVE-2026-40372

ASP.NET Core Elevation of Privilege Vulnerability

State: Published
Severity: 9.1 Critical
Published: Apr 21, 2026
Updated: Oct 15, 2026
Reserved: Apr 11, 2026

Description

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C	microsoft
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat-SADP

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
ASP.NET Core 10.0Microsoft	10.0 to before 10.0.7Affected
Microsoft Visual Studio 2026 version 18.5Microsoft	18.5.0 to before 18.5.2Affected

References

ASP.NET Core Elevation of Privilege Vulnerabilityvendor-advisorypatch
https://access.redhat.com/security/cve/CVE-2026-40372vdb-entry
RHBZ#2460224issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.