Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

Source: The Hacker News

Overview

Microsoft has released out‑of‑band updates to address a security vulnerability in ASP.NET Core that could allow an attacker to escalate privileges.

Vulnerability Details

• CVE ID: CVE‑2026‑40372
• CVSS Score: 9.1 / 10.0 (rated Important)
• Discovery: Reported by an anonymous researcher.

The issue stems from improper verification of cryptographic operations within ASP.NET Core, which can be exploited to gain higher privileges than intended.

Mitigation

Microsoft recommends applying the out‑of‑band updates immediately. The patches are available through the standard Windows Update channels and can also be downloaded manually from the Microsoft Update Catalog.

References

• Microsoft Security Advisory for CVE‑2026‑40372
• National Vulnerability Database entry for CVE‑2026‑40372