Vulnerability intelligence
CVE-2026-40372
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVSS Score
9.1
Critical
EPSS — Exploit Probability
11%
Riskier than 96% of all CVEs · checked 2026-09-05
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered Apr 22, 2026 · latest Apr 22, 2026
Coverage timeline
-
Emergency ASP.NET Core patch fixes CVE-2026-40372 Linux/macOS flawarstechnica.com · Apr 22, 2026
-
Microsoft issues emergency fix for ASP.NET Core SYSTEM flawsecurityaffairs.com · Apr 22, 2026
-
Microsoft fixes ASP.NET Core privilege escape CVE-2026-40372thehackernews.com · Apr 22, 2026