Product:
ASP.NET Core
Summary
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. This vulnerability can lead to significant security risks, including unauthorized access to sensitive data and system control. It is classified as critical due to its high impact on confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2026-40372 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests over the network to the affected ASP.NET Core application. Since the attack complexity is low and no privileges are required, even unauthenticated users can potentially exploit this flaw to gain elevated privileges.
Affected Products
- ASP.NET Core: Vulnerable due to improper cryptographic signature verification, allowing privilege escalation.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security updates provided by Microsoft. Additionally, implementing strict access controls and monitoring network traffic can help reduce the risk of exploitation.