CVE-2026-40372 ASP.NET Core Elevation of Privilege Vulnerability
An attacker can elevate privileges by exploiting improper cryptographic signature verification in ASP.NET Core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40372?
CVE-2026-40372 is a critical authentication bypass vulnerability in Microsoft ASP.NET Core 10.0, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Weakness: CWE-347
Which versions are affected by CVE-2026-40372?
3 open source packages ship an affected version, including Microsoft.AspNetCore.DataProtection and aspnet-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.AspNetCore.DataProtection NuGet | From 10.0.0 | 10.0.7 |
Microsoft.AspNetCore.DataProtection NuGet | From 10.0.0 | 10.0.7 |
aspnet-core Bitnami | From 10.0.0 | 10.0.7 |
Products include Microsoft Asp.net Core.
How do I fix CVE-2026-40372?
Upgrade Microsoft.AspNetCore.DataProtection to 10.0.7 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-40372 being exploited?
There is no known exploitation of CVE-2026-40372 in the wild and no public exploit code.
Other vulnerabilities in Microsoft ASP.NET Core 10.0
- CVE-2025-55315 ASP.NET Security Feature Bypass Vulnerability
- CVE-2026-88092 ASP.NET Core Tampering Vulnerability
- CVE-2021-43877 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- CVE-2020-0603 Remote code execution in ASP.NET Core
- CVE-2019-1302 Elevation of privilege in ASP.NET Core
Sources
Also known as BIT-aspnet-core-2026-40372, GHSA-9mv3-2cwr-p262, UBUNTU-CVE-2026-40372.