CVE-2026-40372

CVE-2026-40372 is a critical vulnerability in ASP.NET Core stemming from improper verification of cryptographic signatures, which enables unauthorized attackers to escalate privileges over network connections. The flaw allows remote exploitation without authentication or user interaction, making it a high-risk threat to affected systems. The vulnerability carries a CVSS score of 9.1 (Critical) with network-based attack vectors and low complexity requirements. It poses significant confidentiality and integrity risks, potentially allowing attackers to gain unauthorized elevated access to systems. The FAUCET Risk Score of 53.0/100 reflects moderate but meaningful operational risk. Currently, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The extremely low EPSS score of 0.000390000 indicates minimal probability of exploitation, and community attention appears limited at present. However, the critical CVSS rating warrants prompt patching and monitoring despite current low exploitation activity.