CVE-2026-40372: exploitation status and patch state

CVE-2026-40372 · CVSS 9.1 CRITICAL · EPSS 11% · patch available

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Is CVE-2026-40372 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 11%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Microsoft · ASP.NET Core 10.0 · >= 10.0, < 10.0.7
• Microsoft · Microsoft Visual Studio 2026 version 18.5 · >= 18.5.0, < 18.5.2

Is there a patch?

Yes. Update to one of these or later:

From Microsoft's CVE record · Microsoft advisory

• KB5091596
• Release Notes

From Microsoft's Security Update Guide · Microsoft advisory

What PlainSec published about CVE-2026-40372

• RDP phishing warning breaks on mixed-scale monitors (2026-04-25)
• ASP.NET Core token forgery leaves privileged sessions behind (2026-04-23)

Primary sources

• NVD record
• Microsoft KB5091596
• Microsoft Release Notes
• Microsoft advisory

KEV and EPSS are re-checked daily. Record last updated 2026-10-25.