This vulnerability (CVE-2026-40372) affects Microsoft ASP.NET Core 10.0 and is categorized under CWE-347, which pertains to improper verification of cryptographic signatures. Due to this flaw, an attacker can bypass signature verification mechanisms, enabling privilege escalation remotely. The vulnerability is remotely exploitable with no privileges or user interaction required, and it impacts confidentiality and integrity with no impact on availability. Microsoft has published an official fix to remediate the issue.

Successful exploitation of this vulnerability allows an attacker to elevate privileges over the network, potentially gaining unauthorized access to sensitive data or functionality within ASP.NET Core 10.0 applications. The impact is critical, affecting confidentiality and integrity of the system. There are currently no known exploits in the wild.

An official fix is available from Microsoft. Users and administrators of ASP.NET Core 10.0 should apply the vendor-provided patch as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372 for detailed remediation instructions.