p PatchFirst

CVE-2026-40372

CVE-2026-40372 · ASP.NET Core Elevation of Privilege Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 9.1 · Critical · EPSS 11.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • asp.net core 10.0

    Versions
    • ≥ 10.0, < 10.0.7: Affected (custom)

    Update to 10.0.7

  • microsoft visual studio 2026 version 18.5

    Versions
    • ≥ 18.5.0, < 18.5.2: Affected (custom)

    Update to 18.5.2

  • dotnet7 Ubuntu:22.04:LTS

    Versions
    • 7.0.105-0ubuntu1~22.04.1
    • 7.0.107-0ubuntu1~22.04.1
    • 7.0.108-0ubuntu1~22.04.1
    • 7.0.109-0ubuntu1~22.04.1
    • 7.0.110-0ubuntu1~22.04.1
    • 7.0.111-0ubuntu1~22.04.1
    • 7.0.112-0ubuntu1~22.04.1
    • 7.0.113-0ubuntu1~22.04.1
    • 7.0.114-0ubuntu1~22.04.1
    • 7.0.115-0ubuntu1~22.04.1
    • 7.0.116-0ubuntu1~22.04.1
    • 7.0.117-0ubuntu1~22.04.1
    • 7.0.117-0ubuntu1~22.04.2
    • 7.0.119-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dotnet10 Ubuntu:24.04:LTS

    Versions
    • 10.0.100-10.0.0-0ubuntu1~24.04.1
    • 10.0.101-10.0.1-0ubuntu1~24.04.2
    • 10.0.103-10.0.3-0ubuntu1~24.04.1
    • 10.0.104-10.0.4-0ubuntu1~24.04.1
    • 10.0.105-10.0.5-0ubuntu1~24.04.1
    • 10.0.106-10.0.6-0ubuntu1~24.04.1
    Affected ranges
    • ECOSYSTEM: < 10.0.107-10.0.7-0ubuntu1~24.04.1

    Update to 10.0.107-10.0.7-0ubuntu1~24.04.1

  • dotnet10 Ubuntu:25.10

    Versions
    • 10.0.100-10.0.0~rc1-0ubuntu1
    • 10.0.100-10.0.0~rc2-0ubuntu1~25.10.2
    • 10.0.100-10.0.0-0ubuntu1~25.10.1
    • 10.0.101-10.0.1-0ubuntu1~25.10.2
    • 10.0.103-10.0.3-0ubuntu1~25.10.1
    • 10.0.104-10.0.4-0ubuntu1~25.10.1
    • 10.0.105-10.0.5-0ubuntu1~25.10.1
    • 10.0.106-10.0.6-0ubuntu1~25.10.1
    Affected ranges
    • ECOSYSTEM: < 10.0.107-10.0.7-0ubuntu1~25.10.1

    Update to 10.0.107-10.0.7-0ubuntu1~25.10.1

  • dotnet10 Ubuntu:26.04:LTS

    Versions
    • 10.0.100-10.0.0~rc1-0ubuntu1
    • 10.0.100-10.0.0~rc2-0ubuntu1
    • 10.0.100-10.0.0-0ubuntu1
    • 10.0.100-10.0.0-0ubuntu2
    • 10.0.101-10.0.1-0ubuntu1
    • 10.0.101-10.0.1-0ubuntu2
    • 10.0.101-10.0.1-0ubuntu3
    • 10.0.102-10.0.2-0ubuntu1
    • 10.0.103-10.0.3-0ubuntu1
    • 10.0.104-10.0.4-0ubuntu1
    • 10.0.105-10.0.5-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 10.0.107-10.0.7-0ubuntu1~26.04.1

    Update to 10.0.107-10.0.7-0ubuntu1~26.04.1

Original sources

Check your server →