Critical ASP.NET Core Flaw: Privilege Escalation via Signature Bypass

The National Vulnerability Database has disclosed CVE-2026-40372, a critical vulnerability in ASP.NET Core that allows for remote privilege escalation. Rated with a CVSS score of 9.1 (CRITICAL), this flaw stems from an improper verification of cryptographic signatures, enabling an unauthorized attacker to gain elevated access over a network.

This isn’t a theoretical issue; it’s a fundamental cryptographic bypass. An attacker doesn’t need to steal credentials or exploit a memory corruption bug. They can craft malicious data that your ASP.NET Core application thinks is legitimate due to a failure in validating its cryptographic signature. The impact is direct: an unauthenticated attacker can achieve high integrity, effectively taking control of the affected application or system. This is a red teamer’s dream and a CISO’s nightmare.

Defenders need to treat this with extreme urgency. The lack of specificity on affected products from the National Vulnerability Database means a broad range of ASP.NET Core deployments could be vulnerable. Assume your systems are exposed until proven otherwise. This is a textbook example of CWE-347, ‘Improper Neutralization of Invalid or Malicious XML Name according to a White List,’ though in this case, it applies to cryptographic signatures rather than XML.