ASP.NET Core CVE-2026-40372

No special conditions required - remote unauthenticated exploitation against default configurations of ASP.NET Core 10.0 applications implementing JWT authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation with low complexity and no authentication barriers. Exploitation specifically targets applications using JWT-based authentication mechanisms; ASP.NET Core deployments not implementing JWT authentication are not vulnerable through this attack vector. No user interaction required, enabling fully automated exploitation. The vulnerability is limited to ASP.NET Core version 10.0 per CPE data; other versions are not confirmed affected by this specific signature verification flaw.

This vulnerability presents critical real-world risk despite no confirmed active exploitation. The CVSS 9.1 score accurately reflects the severe impact: network-accessible (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). Attackers can directly target internet-facing ASP.NET Core APIs. The authentication bypass nature means complete privilege escalation to any user role, including administrative accounts. While EPSS data is not provided, authentication bypass vulnerabilities in popular frameworks historically show rapid exploitation once details emerge. The JWT attack tag indicates likely exploit reliability once the signature verification flaw is understood. Primary risk factors: widespread ASP.NET Core deployment in enterprise environments, network exposure of APIs, and high attacker interest in authentication bypasses. Mitigating factor: patch available from Microsoft reduces window of vulnerability for organizations with robust patch management. Organizations running ASP.NET Core 10.0 in production should treat this as emergency-priority patching.

An unauthenticated remote attacker crafts a malicious JWT with administrative user claims and a forged or manipulated signature. The attacker sends this token to a vulnerable ASP.NET Core 10.0 API endpoint. Due to improper signature verification (CWE-347), the application accepts the forged token as valid, granting the attacker full administrative privileges. The attacker then accesses sensitive data, modifies application configuration, or exfiltrates confidential information without any legitimate credentials. Public exploit code status unknown at time of analysis, but exploitation likely straightforward given the low complexity (AC:L) and well-understood JWT attack techniques.