Microsoft .NET Vulnerability Enables Privilege Escalation (CVE-2026-40372)
Summary
CERT-FR issued advisory CERTFR-2026-AVI-0478 on 22 April 2026 alerting to a privilege escalation vulnerability in Microsoft .NET. The vulnerability, tracked as CVE-2026-2026-40372 and disclosed by Microsoft on 21 April 2026, affects ASP.NET Core 10.0 versions prior to 10.0.7. Affected organisations are advised to apply patches from Microsoft's security bulletin.
Organisations running ASP.NET Core 10.0 should verify whether they are on versions prior to 10.0.7 and prioritise patching. Given the privilege escalation risk, affected systems handling sensitive operations or serving as authentication boundaries warrant the highest urgency.
About this source
GovPing monitors CERT-FR Security Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 183 changes logged to date.
What changed
CERT-FR published a security advisory alerting to a privilege escalation vulnerability in Microsoft .NET, specifically affecting ASP.NET Core 10.0 versions prior to 10.0.7. The vulnerability, tracked as CVE-2026-40372 and sourced from Microsoft's security bulletin of 21 April 2026, allows an attacker to elevate privileges on affected systems.
Organisations running affected ASP.NET Core 10.0 deployments should apply the latest vendor patches without delay. As this is a US vendor product with global reach, entities across all sectors using Microsoft .NET should treat this as a priority patch cycle.
What to do next
- Apply vendor patches from Microsoft security bulletin for CVE-2026-40372
Archived snapshot
Apr 22, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Premier Ministre S.G.D.S.N
Agence nationale
de la sécurité des
systèmes d'information
Paris, le 22 avril 2026 N° CERTFR-2026-AVI-0478 Affaire suivie par: CERT-FR
Avis du CERT-FR
Objet: Vulnérabilité dans Microsoft .Net
Gestion du document
| Référence | CERTFR-2026-AVI-0478 |
| Titre | Vulnérabilité dans Microsoft .Net |
| Date de la première version | 22 avril 2026 |
| Date de la dernière version | 22 avril 2026 |
| Source(s) | Bulletin de sécurité Microsoft .Net CVE-2026-40372 du 21 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.
Risque
- Élévation de privilèges
Systèmes affectés
- ASP.NET Core 10.0 versions antérieures à 10.0.7
Résumé
Une vulnérabilité a été découverte dans Microsoft .Net. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Documentation
- Bulletin de sécurité Microsoft .Net CVE-2026-40372 du 21 avril 2026
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
- Référence CVE CVE-2026-40372
- https://www.cve.org/CVERecord?id=CVE-2026-40372
Gestion détaillée du document
- le 22 avril 2026 Version initiale
Related changes
Get daily alerts for CERT-FR Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ANSSI.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-FR Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.