Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-40372: ASP.NET Core: Unauthorized Privilege Elevation over Network
CVE-2026-40372 · published 6 months ago
Summary
A security issue in ASP.NET Core allows an attacker to access restricted areas of a network if they can manipulate a specific request. This could lead to unauthorized access to sensitive data or systems. To protect against this, update your ASP.NET Core application to the latest version or patch.
What to do
- Update microsoft microsoft.aspnetcore.dataprotection to version 10.0.7.
- Update aspnet-core to version 10.0.7.
- Update microsoft asp.net_core to version 10.0.7 or later.
- Update microsoft asp.net core 10.0 to version 10.0.7 or later.
- Update microsoft microsoft visual studio 2026 version 18.5 to version 18.5.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | microsoft | microsoft.aspnetcore.dataprotection |
>= 10.0.0, <= 10.0.6 Fix: upgrade to 10.0.7
|
| Bitnami | – | aspnet-core |
>= 10.0.0, < 10.0.7 Fix: upgrade to 10.0.7
|
| NuGet | microsoft | microsoft.aspnetcore.dataprotection |
>= 10.0.0, < 10.0.7 Fix: upgrade to 10.0.7
|
| – | microsoft | asp.net_core |
>= 10.0.0, < 10.0.7 cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* |
| – | microsoft | asp.net core 10.0 | < 10.0.7 |
| – | microsoft | microsoft visual studio 2026 version 18.5 | < 18.5.2 |
Original advisory text
ASP.NET Core Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
References
- https://access.redhat.com/security/cve/CVE-2026-40372 URL
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372 Vendor Advisory
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-9mv3-2cwr-p262
- https://github.com/dotnet/announcements/issues/395
- https://github.com/advisories/GHSA-9mv3-2cwr-p262
- https://github.com/dotnet/aspnetcore Product
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-40372
- https://bugzilla.redhat.com/show_bug.cgi?id=2460224 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published21 Apr 2026
Updated26 Oct 2026
First seen21 Apr 2026
Sources
CVE-2026-40372 · NVD
GHSA-9mv3-2cwr-p262 · GHSA
GHSA-9mv3-2cwr-p262 · OSV
CVE-2026-40372 · MITRE
CVE-2026-40372 · OSV
Track software like this
Free during beta