This vulnerability (CVE-2026-40372) in Microsoft ASP.NET Core 10.0 is classified under CWE-347, indicating improper verification of cryptographic signatures. The flaw enables an attacker to elevate privileges remotely with no required privileges or user interaction. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. Microsoft has published an official fix for this vulnerability as detailed in their security update guide.

Successful exploitation allows an attacker to elevate privileges remotely, compromising confidentiality and integrity of affected systems running ASP.NET Core 10.0. This could lead to unauthorized access and control over application components or data. There are no reports of active exploitation in the wild currently.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372) to remediate this vulnerability. No additional mitigations are specified by the vendor.