CVE-2026-40372

—

CVSS 3.1

9.1 critical

EPSS

11%p96

Published

Apr 21, 2026 (Apr 21, 2026)

Modified

Jul 15, 2026

Description

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Vendors: microsoft
Products: asp.net core
Weakness: CWE-347
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (11.2%)

In the news5 stories

May 2026 Patch Tuesday forecast: AI starts driving security industry changes

Help Net SecurityMay 12, 19:03 UTC · May 12, 2026Vulnerability CVE-2026-40372 CVE-2026-33825 CVE-2026-314311

60

Microsoft issues emergency update for macOS and Linux ASP.NET threat

Ars Technica · SecurityApr 22, 19:32 UTC · Apr 22, 2026Vulnerability CVE-2026-40372

60

Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw

Security AffairsApr 22, 14:00 UTC · Apr 22, 2026Vulnerability CVE-2026-40372

60

Microsoft Patches Critical ASP.NET Core CVE-2026

The Hacker NewsApr 22, 09:29 UTC · Apr 22, 2026Vulnerability CVE-2026-40372

60

⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More

The Hacker NewsApr 28, 07:38 UTC · Apr 28, 2026Malware CVE-2025-20333 CVE-2025-20362 CVE-2026-40372+20 CVEs1

47