A recently disclosed vulnerability (CVE-2026-40372) affects a Windows-based application and may allow unauthenticated remote attackers to escalate privileges.
Severity level
CVSS Score: 9.1/Critical.
Description:- CVE‑2026‑40372 is a critical security vulnerability that arises from improper control of file names or file paths within a Windows-based application. The affected component processes user-supplied file path inputs without adequately validating or restricting them. Due to this insufficient validation, an unauthenticated remote attacker can supply specially crafted path inputs to manipulate underlying file system operations. This may allow file access or modification outside the intended directory scope, ultimately enabling the attacker to perform actions with elevated privileges.
Affected Versions :- Â
Microsoft AspNetCore.DataProtection Package versions (10.0.0 – 10.0.6)
Impact:-
Successful exploitation may allow attacker to Escalate privileges on the affected system.
Resolution:-
Upgrade the affected package to:
- Microsoft.AspNetCore.DataProtection version 10.0.7.
Rebuild and redeploy affected applications.
Rotate Data Protection keys and invalidate existing sessions/tokens to remove forged credentials.
Mitigations:-
- Restrict external/network access to affected applications.
- Identify applications with direct or transitive dependencies on vulnerable Data Protection packages.
- Monitor application and authentication logs for anomalous behaviour.
Reference:-
UIT Information Security