CVE-2026-40321

High

Published: 17 April 2026

Published

17 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 8.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Score 0.0004 13.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40321 is a high-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Dnnsoftware Dotnetnuke. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of uploaded files to detect and block specially crafted SVGs containing executable scripts, directly preventing the XSS vulnerability.

SI-15 Information Output Filtering good match

prevent

Mandates filtering of information outputs when rendering uploaded SVG files to neutralize embedded scripts and prevent XSS execution against users.

SI-2 Flaw Remediation good match

prevent

Ensures timely flaw remediation by applying the DNN 10.2.2 patch that fixes the SVG upload script injection issue.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

XSS vulnerability in public-facing DNN CMS directly enables exploitation of public-facing web applications (T1190) and facilitates JavaScript execution via malicious SVG upload (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN…

users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

Deeper analysisAI

CVE-2026-40321 is a cross-site scripting (XSS) vulnerability, classified under CWE-87, affecting DNN (formerly DotNetNuke), an open-source web content management system (CMS) in the Microsoft ecosystem. In versions prior to 10.2.2, the platform allows a user to upload a specially crafted SVG file containing scripts. These scripts can target both authenticated and unauthenticated DNN users, with greater impact if executed by a power user. The vulnerability has a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).

An attacker with low privileges (PR:L) can exploit this issue over the network (AV:N) by uploading the malicious SVG file, though it requires high attack complexity (AC:H) and user interaction (UI:R), such as a victim viewing or interacting with the file. Successful exploitation changes the scope (S:C) and grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary script execution in the context of targeted users, including stealing session data, defacing content, or performing other malicious actions.

The DNN Platform version 10.2.2 fully patches this vulnerability, as detailed in the official release notes and security advisory. Security practitioners should upgrade to at least version 10.2.2 and review upload handling for SVG and similar file types, validating inputs to prevent script injection. Relevant resources include the GitHub release page at https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2 and the security advisory at https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4.