CVE-2026-40372GHSA-9MV3-2CWR-P262BIT-ASPNET-CORE-2026-40372
ASP.NET Core Elevation of Privilege Vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 10.0.7, 18.5.2
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Affected versions
- Microsoft ASP.NET Core 10.0
From 10.0 · fixed in 10.0.7
- Microsoft Microsoft Visual Studio 2026 version 18.5
From 18.5.0 · fixed in 18.5.2
- aspnet-coreBitnami
From 10.0.0 · fixed in 10.0.7
- Microsoft.AspNetCore.DataProtectionNuGet
From 10.0.0 · fixed in 10.0.7