Vulnerability-Lookup

CVE-2026-40372 (GCVE-0-2026-40372)

Vulnerability from cvelistv5 – Published: 2026-04-21 19:20 – Updated: 2026-08-14 16:31

Title

ASP.NET Core Elevation of Privilege Vulnerability

Summary

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-21 00:00 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

microsoft mitre root

References

4 references

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch
https://access.redhat.com/security/cve/CVE-2026-40372	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2460224	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

6 products

Vendor	Product	Version	CPE status
Microsoft	ASP.NET Core 10.0	Affected: 10.0 , < 10.0.7 (custom)	guessed
Microsoft	Microsoft Visual Studio 2026 version 18.5	Affected: 18.5.0 , < 18.5.2 (custom)	guessed
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Date Public

2026-04-21 14:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T03:56:11.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet10.0",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet10.0",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet10.0",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "dotnet10.0",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-21T19:20:50.215Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in ASP.NET Core due to improper verification of cryptographic signatures. An unauthorized attacker can exploit this vulnerability remotely over a network, leading to privilege escalation."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Critical"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T02:45:28.657Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-40372"
          },
          {
            "name": "RHBZ#2460224",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460224"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-21T20:01:18.286Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-21T19:20:50.215Z",
            "value": "Made public."
          }
        ],
        "title": "ASP.NET Core: ASP.NET: ASP.NET Core: Privilege escalation via improper cryptographic signature verification",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ASP.NET Core 10.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.7",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2026 version 18.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "18.5.2",
              "status": "affected",
              "version": "18.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.7",
                  "versionStartIncluding": "10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "18.5.2",
                  "versionStartIncluding": "18.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-04-21T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:31:33.569Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "ASP.NET Core Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372"
        }
      ],
      "title": "ASP.NET Core Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-40372",
    "datePublished": "2026-04-21T19:20:50.215Z",
    "dateReserved": "2026-04-11T23:06:15.615Z",
    "dateUpdated": "2026-08-14T16:31:33.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40372",
      "date": "2026-09-16",
      "epss": "0.11205",
      "percentile": "0.95727"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40372\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2026-04-21T20:16:59.133\",\"lastModified\":\"2026-07-15T02:21:05.553\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\"}],\"affected\":[{\"source\":\"secure@microsoft.com\",\"affectedData\":[{\"vendor\":\"Microsoft\",\"product\":\"ASP.NET Core 10.0\",\"versions\":[{\"version\":\"10.0\",\"lessThan\":\"10.0.7\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Visual Studio 2026 version 18.5\",\"versions\":[{\"version\":\"18.5.0\",\"lessThan\":\"18.5.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"dotnet10.0\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"dotnet10.0\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"dotnet10.0\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"dotnet10.0\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-21T00:00:00+00:00\",\"id\":\"CVE-2026-40372\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.7\",\"matchCriteriaId\":\"001BC473-2D30-41BA-8E83-E80A22F519D3\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-40372\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2460224\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Critical",
      "current_release_date": "2026-07-14T13:07:30+00:00",
      "cve": "CVE-2026-40372",
      "id": "CVE-2026-40372",
      "initial_release_date": "2026-04-21T19:20:50.215000+00:00",
      "product_status:known_not_affected": "47",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ASP.NET Core: ASP.NET: ASP.NET Core: Privilege escalation via improper cryptographic signature verification",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"ASP.NET Core: ASP.NET: ASP.NET Core: Privilege escalation via improper cryptographic signature verification\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Critical\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"dotnet10.0\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"dotnet10.0\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"dotnet10.0\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"dotnet10.0\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-21T20:01:18.286Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-21T19:20:50.215Z\", \"value\": \"Made public.\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-21T19:20:50.215Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-40372\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2460224\", \"name\": \"RHBZ#2460224\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json\", \"tags\": [\"x_sadp-csaf-vex\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in ASP.NET Core due to improper verification of cryptographic signatures. An unauthorized attacker can exploit this vulnerability remotely over a network, leading to privilege escalation.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"Improper Verification of Cryptographic Signature\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-15T02:45:28.657Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40372\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-21T19:40:46.203140Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-21T19:40:48.644Z\"}}], \"cna\": {\"title\": \"ASP.NET Core Elevation of Privilege Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"ASP.NET Core 10.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0\", \"lessThan\": \"10.0.7\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft Visual Studio 2026 version 18.5\", \"versions\": [{\"status\": \"affected\", \"version\": \"18.5.0\", \"lessThan\": \"18.5.2\", \"versionType\": \"custom\"}]}], \"datePublic\": \"2026-04-21T14:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372\", \"name\": \"ASP.NET Core Elevation of Privilege Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"CWE-347: Improper Verification of Cryptographic Signature\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"10.0.7\", \"versionStartIncluding\": \"10.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"18.5.2\", \"versionStartIncluding\": \"18.5.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2026-08-14T16:31:33.569Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40372\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-14T16:31:33.569Z\", \"dateReserved\": \"2026-04-11T23:06:15.615Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2026-04-21T19:20:50.215Z\", \"assignerShortName\": \"microsoft\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-05725

Vulnerability from fstec - Published: 21.04.2026

Title

Уязвимость программной платформы ASP.NET Core, связанная с ошибками проверки криптографической подписи, позволяющая нарушителю повысить свои привилегии

Description

Уязвимость программной платформы ASP.NET Core связана с ошибками проверки криптографической подписи. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии

Severity


                    
                      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vendor

ООО «Ред Софт», Microsoft Corp

Software Name

РЕД ОС (запись в едином реестре российских программ №3751), ASP.NET Core

Software Version

7.3 (РЕД ОС), 8.0 (РЕД ОС), до 10.0.7 (ASP.NET Core)

Possible Mitigations

Использование рекомендаций производителя: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40372 Для Ред ОС: https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-40372

Reference

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40372 https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-40372

CWE

CWE-347

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.3 (\u0420\u0415\u0414 \u041e\u0421), 8.0 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 10.0.7 (ASP.NET Core)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40372\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttps://redos.red-soft.ru/search/?iblock_id=24\u0026q=CVE-2026-40372",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "21.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.04.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-05725",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-40372",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), ASP.NET Core",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b ASP.NET Core, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (CWE-347)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b ASP.NET Core \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40372\nhttps://redos.red-soft.ru/search/?iblock_id=24\u0026q=CVE-2026-40372",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-347",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,4)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,1)"
}

CERTFR-2026-AVI-0478

Vulnerability from certfr_avis - Published: 2026-04-22 - Updated: 2026-04-22

Une vulnérabilité a été découverte dans Microsoft .Net. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Microsoft	.Net	ASP.NET Core 10.0 versions antérieures à 10.0.7

References

Title

Publication Time

FKIE_CVE-2026-40372

Vulnerability from fkie_nvd - Published: 2026-04-21 20:16 - Updated: 2026-07-15 02:21

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

References

URL	Tags
secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372	Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-40372
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2460224
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json

Impacted products

	Vendor	Product	Version
	microsoft	asp.net_core	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ASP.NET Core 10.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.7",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2026 version 18.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "18.5.2",
              "status": "affected",
              "version": "18.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    },
    {
      "affectedData": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "dotnet10.0",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "dotnet10.0",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "dotnet10.0",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "dotnet10.0",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "001BC473-2D30-41BA-8E83-E80A22F519D3",
              "versionEndExcluding": "10.0.7",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network."
    }
  ],
  "id": "CVE-2026-40372",
  "lastModified": "2026-07-15T02:21:05.553",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40372",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-21T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-21T20:16:59.133",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-40372"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460224"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40372.json"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-9MV3-2CWR-P262

Vulnerability from github – Published: 2026-04-23 14:55 – Updated: 2026-04-24 19:59

Summary

Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

Details

Executive Summary:

A bug in Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to execute an Elevation of Privilege attack by forging authentication cookies, and also allows some protected payloads to be decrypted.

If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens (session refresh, API key, password reset link, etc.) to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.

This is comparable in capability to MS10-070, which exploited a similar padding-oracle condition in ASP.NET's legacy encryption infrastructure.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/395

CVSS Details

Version: 3.1
Severity: Important
Score: 9.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-347: Improper Verification of Cryptographic Signature

Affected Platforms

Platforms: All
Architectures: All

Affected Packages

The vulnerability affects some Microsoft .NET projects if they use any of affected package versions listed below

ASP.NET Core 10

Package name	Affected version	Patched version
Microsoft.AspNetCore.DataProtection	>=10.0.0, <=10.0.6	10.0.7

Advisory FAQ

How do I know if I am affected?

Primary affected configuration (10.0.6 on `net10.0`)

You are affected if ALL of the following are true:

Your application referenced Microsoft.AspNetCore.DataProtection version 10.0.6 from NuGet (directly or transitively via, e.g., Microsoft.AspNetCore.DataProtection.StackExchangeRedis, .EntityFrameworkCore, .AzureKeyVault, .AzureStorage, .Redis), AND The affected 10.0.6 NuGet binary was actually loaded at runtime. This happens when either the application does NOT target the Microsoft.NET.Sdk.Web NOR has a Microsoft.AspNetCore.App framework reference either directly or transitively UNLESS you opt out of PrunePackageReference which is enabled by default in .NET 10.
The application ran on Linux, macOS, or any non-Windows operating system.

Secondary affected configuration (10.0.x on `net462` / `netstandard2.0`)

You are also affected if:

Your application or library referenced Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6 from NuGet, AND
The build consumed the net462 or netstandard2.0 target framework asset of that package. This occurs when your application does not target net10.0 and consumes the package (e.g. net8.0, net9.0, net481 for mono, etc.). This combination is unusual because 10.0 NuGet packages are generally intended for use with .NET 10.

This secondary population is much smaller and is expected to primarily consist of: - Desktop or server applications on .NET Framework that happen to use the ASP.NET Core DataProtection NuGet package. - Libraries that target netstandard2.0 and reference the 10.0 DataProtection package.

These configurations use the same managed authenticated encryptor code path on all operating systems (the CNG path is only available on the net10.0 asset), so the Windows exception below does not apply to them.

Not affected

Your application runs on Windows
Your application runs framework-dependent on net10.0 and your installed ASP.NET Core shared framework version is ≥ your PackageReference version of Microsoft.AspNetCore.DataProtection. In this case the (correct) shared framework copy is loaded and the NuGet copy is not used. For example, shared framework 10.0.6 + PackageReference 10.0.6 is safe; shared framework 10.0.5 + PackageReference 10.0.6 is not.
Your application uses Microsoft.AspNetCore.DataProtection 8.0.x or 9.0.x from NuGet, on any target framework, any operating system, any shared framework version. The defective code path was introduced during 10.0 development and was never backported to the 8.0 or 9.0 servicing branches.
Your application never referenced any affected version of the package.

How do I fix the issue?

Upgrade Microsoft.AspNetCore.DataProtection to 10.0.7 or later and redeploy. This fixes the validation routine. Any forged payloads produced during the vulnerable window (which necessarily carried all-zero HMAC bytes) will be rejected by the corrected code.
Rotate the DataProtection key ring if your application was affected and served internet-exposed endpoints during the vulnerable window. This invalidates any legitimately-signed tokens the application may have issued to attackers during that period.

Example using the built-in key manager:

```csharp // Run once, from an application with access to the same key ring. // Replace the cutoff with a timestamp just before you deployed 10.0.6. var services = new ServiceCollection() .AddDataProtection() // ... your existing repository / protection configuration ... .Services .BuildServiceProvider();

var keyManager = services.GetRequiredService(); keyManager.RevokeAllKeys( revocationDate: DateTimeOffset.UtcNow, // revoke all keys currently in the ring reason: "CVE-TBD: DataProtection 10.0.6 validation bypass"); ```

RevokeAllKeys marks every existing key as revoked; a new key is auto-generated on the next protect operation. All users will need to sign in again, all antiforgery tokens will be reissued, etc.

If you can be more surgical — for instance, you know no key older than T was used by an affected process — use RevokeKey(Guid keyId, string reason) instead to revoke only the keys that were active during the vulnerable window.

Audit application-level long-lived artifacts that were created during the vulnerable window and carry identity or capability. These survive key rotation and must be rotated at the application layer:
API keys, refresh tokens, or access tokens stored in your database and issued via a protected endpoint.
Password reset links or email-confirmation tokens that were emitted during the window and have not yet expired.
Any other persistent capability that an authenticated request could have caused your application to issue.

If your application does not issue such long-lived artifacts via authenticated endpoints, key rotation alone is sufficient.

Audit plaintext stored inside protected payloads. If your application stores long-lived secrets (database connection strings, third-party API keys, etc.) inside IDataProtector.Protect output, treat those secrets as potentially disclosed and rotate them at their respective sources.
Review web server logs for anomalous request volume against endpoints that accept protected payloads (auth cookies, antiforgery tokens, state parameters). The padding-oracle attack requires many requests per byte recovered — orders of magnitude more than normal traffic for that endpoint. Sustained high-volume traffic with varying cookie/query-parameter values against a single authenticated endpoint during the vulnerable window is a strong indicator.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main ASP.NET Core repo is located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-40372

Revisions

V1.0 (April 21, 2026): Advisory published.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.6"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.DataProtection"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40372"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-23T14:55:41Z",
    "nvd_published_at": "2026-04-21T20:16:59Z",
    "severity": "CRITICAL"
  },
  "details": "## Executive Summary: \n\nA bug in `Microsoft.AspNetCore.DataProtection` 10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to execute an Elevation of Privilege attack by forging authentication cookies, and also allows some protected payloads to be decrypted.\n\nIf an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue **legitimately-signed** tokens (session refresh, API key, password reset link, etc.) to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.\n\nThis is comparable in capability to [MS10-070](https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-070), which exploited a similar padding-oracle condition in ASP.NET\u0027s legacy encryption infrastructure.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/395\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Important\n- **Score:** 9.1\n- **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n- **Weakness:** CWE-347: Improper Verification of Cryptographic Signature\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\nThe vulnerability affects some Microsoft .NET projects if they use any of affected package versions listed below\n\n### \u003ca name=\"ASP.NET Core 10\"\u003e\u003c/a\u003eASP.NET Core 10\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.DataProtection](https://www.nuget.org/packages/Microsoft.AspNetCore.DataProtection)               | \u003e=10.0.0, \u003c=10.0.6 | 10.0.7\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n \n#### Primary affected configuration (10.0.6 on `net10.0`)\n \nYou are **affected** if ALL of the following are true:\n \n- Your application referenced `Microsoft.AspNetCore.DataProtection` version 10.0.6 from NuGet (directly or transitively via, e.g., `Microsoft.AspNetCore.DataProtection.StackExchangeRedis`, `.EntityFrameworkCore`, `.AzureKeyVault`, `.AzureStorage`, `.Redis`), AND\nThe affected 10.0.6 NuGet binary was actually loaded at runtime. This happens when either the application does NOT target the Microsoft.NET.Sdk.Web NOR has a Microsoft.AspNetCore.App framework reference either directly or transitively UNLESS you opt out of PrunePackageReference which is enabled by default in .NET 10. \n- The application ran on Linux, macOS, or any non-Windows operating system.\n \n#### Secondary affected configuration (10.0.x on `net462` / `netstandard2.0`)\n\nYou are also affected if:\n \n- Your application or library referenced `Microsoft.AspNetCore.DataProtection` versions 10.0.0 through 10.0.6 from NuGet, AND\n- The build consumed the `net462` or `netstandard2.0` target framework asset of that package. This occurs when your application does not target `net10.0` and consumes the package (e.g. `net8.0`, `net9.0`, `net481` for mono, etc.). This combination is unusual because 10.0 NuGet packages are generally intended for use with .NET 10.\n \nThis secondary population is much smaller and is expected to primarily consist of:\n- Desktop or server applications on .NET Framework that happen to use the ASP.NET Core DataProtection NuGet package.\n- Libraries that target `netstandard2.0` and reference the 10.0 DataProtection package.\n \nThese configurations use the same managed authenticated encryptor code path on all operating systems (the CNG path is only available on the `net10.0` asset), so the Windows exception below does not apply to them.\n \n#### Not affected\n \n- Your application runs on **Windows** \n- Your application runs **framework-dependent** on `net10.0` and your installed ASP.NET Core shared framework version is **\u2265** your PackageReference version of `Microsoft.AspNetCore.DataProtection`. In this case the (correct) shared framework copy is loaded and the NuGet copy is not used. For example, shared framework 10.0.6 + PackageReference 10.0.6 is safe; shared framework 10.0.5 + PackageReference 10.0.6 is not.\n- Your application uses `Microsoft.AspNetCore.DataProtection` **8.0.x or 9.0.x** from NuGet, on any target framework, any operating system, any shared framework version. The defective code path was introduced during 10.0 development and was never backported to the 8.0 or 9.0 servicing branches.\n- Your application never referenced any affected version of the package.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n1. **Upgrade `Microsoft.AspNetCore.DataProtection` to 10.0.7 or later** and redeploy. This fixes the validation routine. Any forged payloads produced during the vulnerable window (which necessarily carried all-zero HMAC bytes) will be rejected by the corrected code.\n \n2. **Rotate the DataProtection key ring** if your application was affected and served internet-exposed endpoints during the vulnerable window. This invalidates any legitimately-signed tokens the application may have issued to attackers during that period.\n \n   Example using the built-in key manager:\n \n   ```csharp\n   // Run once, from an application with access to the same key ring.\n   // Replace the cutoff with a timestamp just before you deployed 10.0.6.\n   var services = new ServiceCollection()\n       .AddDataProtection()\n       // ... your existing repository / protection configuration ...\n       .Services\n       .BuildServiceProvider();\n \n   var keyManager = services.GetRequiredService\u003cIKeyManager\u003e();\n   keyManager.RevokeAllKeys(\n       revocationDate: DateTimeOffset.UtcNow,      // revoke all keys currently in the ring\n       reason: \"CVE-TBD: DataProtection 10.0.6 validation bypass\");\n   ```\n \n   `RevokeAllKeys` marks every existing key as revoked; a new key is auto-generated on the next protect operation. All users will need to sign in again, all antiforgery tokens will be reissued, etc.\n \n   If you can be more surgical \u2014 for instance, you know no key older than `T` was used by an affected process \u2014 use `RevokeKey(Guid keyId, string reason)` instead to revoke only the keys that were active during the vulnerable window.\n \n3. **Audit application-level long-lived artifacts** that were created during the vulnerable window and carry identity or capability. These survive key rotation and must be rotated at the application layer:\n   - API keys, refresh tokens, or access tokens stored in your database and issued via a protected endpoint.\n   - Password reset links or email-confirmation tokens that were emitted during the window and have not yet expired.\n   - Any other persistent capability that an authenticated request could have caused your application to issue.\n \n   If your application does not issue such long-lived artifacts via authenticated endpoints, key rotation alone is sufficient.\n \n### Recommended\n \n4. **Audit plaintext stored inside protected payloads.** If your application stores long-lived secrets (database connection strings, third-party API keys, etc.) inside `IDataProtector.Protect` output, treat those secrets as potentially disclosed and rotate them at their respective sources.\n \n5. **Review web server logs** for anomalous request volume against endpoints that accept protected payloads (auth cookies, antiforgery tokens, state parameters). The padding-oracle attack requires many requests per byte recovered \u2014 orders of magnitude more than normal traffic for that endpoint. Sustained high-volume traffic with varying cookie/query-parameter values against a single authenticated endpoint during the vulnerable window is a strong indicator.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main ASP.NET Core repo is located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-40372]( https://www.cve.org/CVERecord?id=CVE-2026-40372)\n\n### Revisions\n\nV1.0 (April 21, 2026): Advisory published.",
  "id": "GHSA-9mv3-2cwr-p262",
  "modified": "2026-04-24T19:59:43Z",
  "published": "2026-04-23T14:55:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/aspnetcore/security/advisories/GHSA-9mv3-2cwr-p262"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40372"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/395"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/aspnetcore"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Security Advisory CVE-2026-40372 \u2013 ASP.NET Core Elevation of Privilege"
}

MSRC_CVE-2026-40372

Vulnerability from csaf_microsoft - Published: 2026-04-14 07:00 - Updated: 2026-04-28 07:00

Summary

ASP.NET Core Elevation of Privilege Vulnerability

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2026-40372.

CVE-2026-40372

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Fixed: 2 products Known affected: 2 products

https://support.microsoft.com/help/5091596 https://learn.microsoft.com/en-us/visualstudio/releases/202…

Open the full advisory

NCSC-2026-0123

Vulnerability from csaf_ncscnl - Published: 2026-04-22 09:40 - Updated: 2026-04-22 09:40

Summary

Kwetsbaarheid verholpen in ASP.NET Core van Microsoft

Scope

1 vulnerability in this advisory, including CVE-2026-40372.

CVE-2026-40372

An improper verification of cryptographic signatures in ASP.NET Core allows unauthorized attackers to remotely elevate privileges by exploiting signature validation flaws.

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Known affected: 1 product

Open the full advisory

ubuntu-cve-2026-40372

Vulnerability from osv_ubuntu

Published

2026-04-21 00:00

Modified

2026-06-29 11:32

Summary

Details

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Severity

9.1 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.1 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-40372	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-40372	REPORT
	https://msrc.microsoft.com/update-guide/vulnerabi…	REPORT
	https://devblogs.microsoft.com/dotnet/dotnet-10-0…	REPORT
	https://github.com/dotnet/announcements/issues/395	REPORT
	https://ubuntu.com/security/notices/USN-8215-1	ADVISORY
	https://ubuntu.com/security/notices/USN-8216-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-host-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-hostfxr-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-runtime-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-sdk-7.0-source-built-artifacts",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet-templates-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "dotnet7",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          },
          {
            "binary_name": "netstandard-targeting-pack-2.1-7.0",
            "binary_version": "7.0.119-0ubuntu1~22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "dotnet7",
        "purl": "pkg:deb/ubuntu/dotnet7@7.0.119-0ubuntu1~22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.105-0ubuntu1~22.04.1",
        "7.0.107-0ubuntu1~22.04.1",
        "7.0.108-0ubuntu1~22.04.1",
        "7.0.109-0ubuntu1~22.04.1",
        "7.0.110-0ubuntu1~22.04.1",
        "7.0.111-0ubuntu1~22.04.1",
        "7.0.112-0ubuntu1~22.04.1",
        "7.0.113-0ubuntu1~22.04.1",
        "7.0.114-0ubuntu1~22.04.1",
        "7.0.115-0ubuntu1~22.04.1",
        "7.0.116-0ubuntu1~22.04.1",
        "7.0.117-0ubuntu1~22.04.1",
        "7.0.117-0ubuntu1~22.04.2",
        "7.0.119-0ubuntu1~22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "aspnetcore-runtime-dbg-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-host-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-hostfxr-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-runtime-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-runtime-dbg-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-sdk-10.0",
            "binary_version": "10.0.107-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version": "10.0.107-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-sdk-aot-10.0",
            "binary_version": "10.0.107-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-sdk-dbg-10.0",
            "binary_version": "10.0.107-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet-templates-10.0",
            "binary_version": "10.0.107-0ubuntu1~24.04.1"
          },
          {
            "binary_name": "dotnet10",
            "binary_version": "10.0.107-10.0.7-0ubuntu1~24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "dotnet10",
        "purl": "pkg:deb/ubuntu/dotnet10@10.0.107-10.0.7-0ubuntu1~24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.107-10.0.7-0ubuntu1~24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.100-10.0.0-0ubuntu1~24.04.1",
        "10.0.101-10.0.1-0ubuntu1~24.04.2",
        "10.0.103-10.0.3-0ubuntu1~24.04.1",
        "10.0.104-10.0.4-0ubuntu1~24.04.1",
        "10.0.105-10.0.5-0ubuntu1~24.04.1",
        "10.0.106-10.0.6-0ubuntu1~24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "aspnetcore-runtime-dbg-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-host-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-hostfxr-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-runtime-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-runtime-dbg-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-sdk-10.0",
            "binary_version": "10.0.107-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version": "10.0.107-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-sdk-aot-10.0",
            "binary_version": "10.0.107-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-sdk-dbg-10.0",
            "binary_version": "10.0.107-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet-templates-10.0",
            "binary_version": "10.0.107-0ubuntu1~25.10.1"
          },
          {
            "binary_name": "dotnet10",
            "binary_version": "10.0.107-10.0.7-0ubuntu1~25.10.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "dotnet10",
        "purl": "pkg:deb/ubuntu/dotnet10@10.0.107-10.0.7-0ubuntu1~25.10.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.107-10.0.7-0ubuntu1~25.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.100-10.0.0~rc1-0ubuntu1",
        "10.0.100-10.0.0~rc2-0ubuntu1~25.10.2",
        "10.0.100-10.0.0-0ubuntu1~25.10.1",
        "10.0.101-10.0.1-0ubuntu1~25.10.2",
        "10.0.103-10.0.3-0ubuntu1~25.10.1",
        "10.0.104-10.0.4-0ubuntu1~25.10.1",
        "10.0.105-10.0.5-0ubuntu1~25.10.1",
        "10.0.106-10.0.6-0ubuntu1~25.10.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "aspnetcore-runtime-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "aspnetcore-runtime-dbg-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "aspnetcore-targeting-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-apphost-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-host-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-hostfxr-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-runtime-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-runtime-dbg-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-sdk-10.0",
            "binary_version": "10.0.107-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version": "10.0.107-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-sdk-aot-10.0",
            "binary_version": "10.0.107-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-sdk-dbg-10.0",
            "binary_version": "10.0.107-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-targeting-pack-10.0",
            "binary_version": "10.0.7-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet-templates-10.0",
            "binary_version": "10.0.107-0ubuntu1~26.04.1"
          },
          {
            "binary_name": "dotnet10",
            "binary_version": "10.0.107-10.0.7-0ubuntu1~26.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "dotnet10",
        "purl": "pkg:deb/ubuntu/dotnet10@10.0.107-10.0.7-0ubuntu1~26.04.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.107-10.0.7-0ubuntu1~26.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.100-10.0.0~rc1-0ubuntu1",
        "10.0.100-10.0.0~rc2-0ubuntu1",
        "10.0.100-10.0.0-0ubuntu1",
        "10.0.100-10.0.0-0ubuntu2",
        "10.0.101-10.0.1-0ubuntu1",
        "10.0.101-10.0.1-0ubuntu2",
        "10.0.101-10.0.1-0ubuntu3",
        "10.0.102-10.0.2-0ubuntu1",
        "10.0.103-10.0.3-0ubuntu1",
        "10.0.104-10.0.4-0ubuntu1",
        "10.0.105-10.0.5-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.",
  "id": "UBUNTU-CVE-2026-40372",
  "modified": "2026-06-29T11:32:10Z",
  "published": "2026-04-21T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-40372"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40372"
    },
    {
      "type": "REPORT",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372"
    },
    {
      "type": "REPORT",
      "url": "https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/dotnet/announcements/issues/395"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8215-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8216-1"
    }
  ],
  "related": [
    "USN-8215-1",
    "USN-8216-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-40372"
  ]
}

WID-SEC-W-2026-1213

Vulnerability from csaf_certbund - Published: 2026-04-21 22:00 - Updated: 2026-05-03 22:00

Summary

Microsoft ASP.NET: Schwachstelle ermöglicht Privilegieneskalation

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-40372.

CVE-2026-40372

Known affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-40372 (GCVE-0-2026-40372)

Solutions

Executive Summary:

Announcement

CVSS Details

Affected Platforms

Affected Packages

ASP.NET Core 10

Advisory FAQ

How do I know if I am affected?

Primary affected configuration (10.0.6 on net10.0)

Secondary affected configuration (10.0.x on net462 / netstandard2.0)

Not affected

How do I fix the issue?

Recommended

Other Information

Reporting Security Issues

Support

Disclaimer

External Links

Revisions

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour

Primary affected configuration (10.0.6 on `net10.0`)

Secondary affected configuration (10.0.x on `net462` / `netstandard2.0`)