CVE-2026-40306 Details
Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.
A vulnerability exists in DNN (DotNetNuke) version 10.0.0 prior to 10.2.2, where all new installations share the same Host GUID. This issue does not affect upgrades from version 9.x.x. The vulnerability could lead to problems with GUID uniqueness, which is essential for proper system identification and management.
Users can upgrade to DNN version 10.2.2, which addresses this issue. Instructions for upgrading DNN can be found in the DNN documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2 | [email protected] | Release Notes |
| https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2rhw-gw3f-477j | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dnnsoftware dotnetnuke | >= 10.0.0, < 10.2.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |