Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2026-40321 is a high-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Dnnsoftware Dotnetnuke. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40321 is a cross-site scripting (XSS) vulnerability, classified under CWE-87, affecting DNN (formerly DotNetNuke), an open-source web content management system (CMS) in the Microsoft ecosystem. In versions prior to 10.2.2, the platform allows a user to upload a specially crafted SVG file containing scripts. These scripts can target both authenticated and unauthenticated DNN users, with greater impact if executed by a power user. The vulnerability has a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
An attacker with low privileges (PR:L) can exploit this issue over the network (AV:N) by uploading the malicious SVG file, though it requires high attack complexity (AC:H) and user interaction (UI:R), such as a victim viewing or interacting with the file. Successful exploitation changes the scope (S:C) and grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary script execution in the context of targeted users, including stealing session data, defacing content, or performing other malicious actions.
The DNN Platform version 10.2.2 fully patches this vulnerability, as detailed in the official release notes and security advisory. Security practitioners should upgrade to at least version 10.2.2 and review upload handling for SVG and similar file types, validating inputs to prevent script injection. Relevant resources include the GitHub release page at https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2 and the security advisory at https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24061
Vulnerability Data
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN…
more
users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SA-11 requires developer testing and analysis that can discover improper neutralization of alternate script syntax after it has been coded.
SI-10 directly requires validation/sanitization of untrusted inputs, which structurally stops alternate XSS syntax from reaching the interpreter.
SA-8 mandates secure engineering principles such as input neutralization and output encoding that prevent introduction of this class of flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization and output encoding to prevent alternate XSS syntax.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper neutralization of alternate script syntax, directly eliminating CWE-87.
Security testing catches residual XSS but does not itself implement the neutralization controls.
Secure SDLC mandates input validation and output encoding that directly prevent alternate XSS syntax.
Application security requirements explicitly call for neutralization of untrusted input to block XSS variants.
Secure architecture principles reduce attack surface but do not prescribe specific encoding rules.