NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

Vulnerability3 · 1 read

CVE-2026-40372

CVSS 3.1: 9.1 critical
EPSS: 11%p96
Published: Apr 21, 2026 · Apr 21, 2026
Modified: Oct 26, 2026

Analyze CVE-2026-40372 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Vendors: microsoft

Products: asp.net core

Weakness: CWE-347

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (11.2%)

In the news

5 stories

May 2026 Patch Tuesday forecast: AI starts driving security industry changes

Help Net SecurityMay 12, 19:03 UTC · May 12, 2026VulnerabilityCVE-2026-40372 CVE-2026-33825 CVE-2026-314312

60

Microsoft issues emergency update for macOS and Linux ASP.NET threat

Ars Technica · SecurityApr 22, 19:32 UTC · Apr 22, 2026VulnerabilityCVE-2026-403723

60

Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw

Security AffairsApr 22, 14:00 UTC · Apr 22, 2026VulnerabilityCVE-2026-403723

60

Microsoft Patches Critical ASP.NET Core CVE-2026

The Hacker NewsApr 22, 09:29 UTC · Apr 22, 2026VulnerabilityCVE-2026-403722 · 1 read

60

⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More

The Hacker NewsApr 28, 07:38 UTC · Apr 28, 2026MalwareCVE-2025-20333 CVE-2025-20362 CVE-2026-40372+202

47