Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-40372

Fixed in a distro release EPSS 11%CVSS 9.1

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Published 2026-04-21 · CVE record · OSV

Products: Microsoft ASP.NET Core 10.0, Microsoft Visual Studio 2026 version 18.5, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images

Fixed upstream

EcosystemPackageFixed in
NuGetMicrosoft.AspNetCore.DataProtection10.0.7

Distro releases

ReleasePackageFixed in
Ubuntu 22.04 LTSdotnet7no fix
Ubuntu 24.04 LTSdotnet1010.0.107-10.0.7-0ubuntu1~24.04.1
Ubuntu 25.10dotnet1010.0.107-10.0.7-0ubuntu1~25.10.1
Ubuntu 26.04 LTSdotnet1010.0.107-10.0.7-0ubuntu1~26.04.1