9.1 CriticalCWE-347
CVE-2026-40372
Microsoft ASP.NET Core 10.0 vulnerability
MicrosoftASP.NET Core 10.0
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
11%probability of exploitation in the next 30 days
Higher than 96% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 22 Apr · 10:28 UTC | The Hacker News | Microsoft fixes ASP.NET Core privilege escape CVE-2026-40372 |
| Wed 22 Apr · 15:08 UTC | Security Affairs | Microsoft issues emergency fix for ASP.NET Core SYSTEM flaw |
| Wed 22 Apr · 20:09 UTC | Ars Technica | Emergency ASP.NET Core patch fixes CVE-2026-40372 Linux/macOS flaw |
- Emergency ASP.NET Core patch fixes CVE-2026-40372 Linux/macOS flawArs Technica
- Microsoft issues emergency fix for ASP.NET Core SYSTEM flawSecurity Affairs
- Microsoft fixes ASP.NET Core privilege escape CVE-2026-40372The Hacker News · first in our coverage