Medium severity6.5NVD Advisory· Published Apr 17, 2026· Updated Apr 24, 2026

CVE-2026-40306

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
DotNetNuke.CoreNuGet	>= 10.0.0, < 10.2.2	10.2.2

Affected products

Dnnsoftware/Dotnetnuke
cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*
Range: >=10.0.0,<10.2.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-2rhw-gw3f-477jghsaADVISORY
github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2rhw-gw3f-477jnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-40306ghsaADVISORY
github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2nvdRelease NotesWEB

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.5/ 10

CVSS v46.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

Probability of exploitation in the next 30 days.

0.04%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-330
Use of Insufficiently Random Values

CVE ID

CVE-2026-40306

Source code

github.com/dnnsoftware/Dnn.Platform

Credits

M
meetmandeep
reporter · ghsa
D
donker
remediation_reviewer · ghsa
V
valadas
remediation_developer · ghsa