This vulnerability (CVE-2026-40372) in ASP.NET Core 10.0 is due to improper verification of cryptographic signatures, classified under CWE-347. It enables an attacker to elevate privileges remotely with no required privileges or user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. Microsoft has published an official fix for this vulnerability, and the vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372.

Successful exploitation allows an attacker to elevate privileges remotely, compromising confidentiality and integrity of the affected system. There is no impact on availability reported. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft for ASP.NET Core 10.0. Users and administrators should apply the vendor-provided patch promptly to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372 for detailed patching instructions.