Details of VAR-202604-2759

ID

VAR-202604-2759

CVE

CVE-2026-40372

TITLE

Microsoft's ASP.NET Core Digital Signature Verification Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2026-013557

DESCRIPTION

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. All information handled by the software may be rewritten. Furthermore, the software will not stop. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-40372 // JVNDB: JVNDB-2026-013557

AFFECTED PRODUCTS

vendor:	microsoft	model:	asp.net core	scope:	lt	version:	10.0.7	Trust: 1.0
vendor:	microsoft	model:	asp.net core	scope:	gte	version:	10.0.0	Trust: 1.0
vendor:	マイクロソフト	model:	asp.net core	scope:	eq	version:	-	Trust: 0.8
vendor:	マイクロソフト	model:	asp.net core	scope:	-	version:	-	Trust: 0.8
vendor:	マイクロソフト	model:	asp.net core	scope:	eq	version:	10.0.0 that's all 10.0.7	Trust: 0.8

sources: JVNDB: JVNDB-2026-013557 // NVD: CVE-2026-40372

CVSS

SEVERITY

CVSSV2

CVSSV3

secure@microsoft.com:	CVE-2026-40372
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2026-013557
value:	CRITICAL
Trust: 0.8

secure@microsoft.com:	CVE-2026-40372
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	5.2
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2026-013557
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2026-013557 // NVD: CVE-2026-40372

PROBLEMTYPE DATA

problemtype:	CWE-347	Trust: 1.0
problemtype:	Improper verification of digital signatures (CWE-347) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2026-013557 // NVD: CVE-2026-40372

PATCH

title:

CVE-2026-40372 - Security updates guide - Microsoft - ASP.NET Core Elevation of Privilege Vulnerability

url:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372

Trust: 0.8

sources: JVNDB: JVNDB-2026-013557

EXTERNAL IDS

db:	NVD	id:	CVE-2026-40372	Trust: 2.6
db:	JVNDB	id:	JVNDB-2026-013557	Trust: 0.8

sources: JVNDB: JVNDB-2026-013557 // NVD: CVE-2026-40372

REFERENCES

url:	https://msrc.microsoft.com/update-guide/vulnerability/cve-2026-40372	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2026-40372	Trust: 0.8

sources: JVNDB: JVNDB-2026-013557 // NVD: CVE-2026-40372

SOURCES

db:	JVNDB	id:	JVNDB-2026-013557
db:	NVD	id:	CVE-2026-40372

LAST UPDATE DATE

2026-06-19T22:57:30.504000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2026-013557	date:	2026-04-30T03:28:00
db:	NVD	id:	CVE-2026-40372	date:	2026-04-27T19:57:39.360

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2026-013557	date:	2026-04-30T00:00:00
db:	NVD	id:	CVE-2026-40372	date:	2026-04-21T20:16:59.133