What is the CVSS score of CVE-2026-40372?

CVE-2026-40372 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ASP.NET Core are affected by CVE-2026-40372?

ASP.NET Core 10.0 contains a critical cryptographic signature verification bypass that allows unauthenticated remote attackers to forge JWT authentication tokens and bypass access controls on any…. A patch is available.

How to fix or mitigate CVE-2026-40372?

Within 24 hours: Identify all ASP.NET Core 10.0 deployments in your environment and prioritize internet-facing applications. Within 7 days: Apply Microsoft's released security patch to all affected ASP.NET Core 10.0 instances and validate patch application through version verification. Within 30 days: Complete security testing of patched applications to confirm authentication token validation is functioning correctly and conduct access log review for potential unauthorized token usage during the unpatched window.

ASP.NET Core CVE-2026-40372

EUVD-2026-24249 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-21 microsoft

GHSA-9mv3-2cwr-p262

Authentication Bypass Jwt Attack Asp Net Core 10 0

9.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.9

Severity by source

Vendor (microsoft) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CIRCL (temporal)

7.9 HIGH

cvss

Red Hat

9.1 CRITICAL

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 20:51 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24249

Analysis Generated

Apr 21, 2026 - 20:00 vuln.today

Patch released

Apr 21, 2026 - 20:00 nvd

Patch available

CVE Published

Apr 21, 2026 - 19:20 nvd

CRITICAL 9.1

DescriptionCVE.org

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Cryptographic signature verification bypass in ASP.NET Core 10.0 enables remote unauthenticated attackers to forge authentication tokens and gain unauthorized access to protected resources. Tagged as a JWT attack involving authentication bypass, this vulnerability allows complete compromise of confidentiality and integrity without requiring any special conditions (AV:N/AC:L/PR:N/UI:N). Microsoft has released a security update addressing this flaw. No active exploitation confirmed in CISA KEV at time of analysis, though the authentication bypass nature and network-accessible attack surface present significant risk for widely deployed ASP.NET Core applications.

Technical ContextAI

ASP.NET Core 10.0 implements JSON Web Token (JWT) authentication for API authorization and identity verification. The vulnerability stems from CWE-347 (Improper Verification of Cryptographic Signature), indicating the framework fails to properly validate JWT signature integrity during token authentication. This allows attackers to manipulate or forge JWTs that bypass signature verification checks. The affected CPE (cpe:2.3:a:microsoft:asp.net_core_10.0) identifies Microsoft ASP.NET Core version 10.0 as the impacted platform. JWT attacks typically exploit weaknesses in algorithm selection (e.g., 'none' algorithm acceptance), key confusion, or insufficient signature validation logic, enabling token forgery without possessing the signing secret.

RemediationAI

Apply the security update released by Microsoft immediately per guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372. The vendor advisory specifies the exact patched version resolving the signature verification flaw. Organizations unable to patch immediately should implement compensating controls: restrict network access to ASP.NET Core APIs using firewall rules or VPN requirements to limit exposure to trusted networks only (trade-off: reduces accessibility for legitimate remote users), implement additional authentication layers such as API gateways with independent JWT validation (trade-off: increased latency and architectural complexity), or deploy Web Application Firewall rules to inspect and validate JWT structure and claims (trade-off: may require custom rule development and could introduce false positives). These mitigations reduce but do not eliminate risk; patching remains the definitive solution.