CVE-2026-40306

CVE-2026-40306 affects DNN (DotNetNuke), an open-source web content management platform, where all new installations of versions 10.0.0 through 10.2.1 are provisioned with an identical Host GUID, creating a shared cryptographic identifier across deployments. This vulnerability does not impact users upgrading from version 9.x.x, and the issue was remediated in version 10.2.2. The duplicate GUID could potentially allow attackers with access to one installation to compromise others if exploited in conjunction with other attack methods, though the exact attack surface is limited by the need for additional vulnerabilities or misconfigurations. There is no evidence of active exploitation in the wild, with no public exploit code available and minimal community attention indicated by the inactive Hot List status and near-zero EPSS score of 0.00055. Organizations running DNN 10.0.0 through 10.2.1 should prioritize upgrading to version 10.2.2 to eliminate this configuration-based weakness, particularly if their installations are internet-facing or accessible to untrusted users.