CVE-2026-54784highCWE-311CWE-523

CVE-2026-54784: fallo de gravedad alta en CoreWCF

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CoreWCF+ Monitorear CoreWCF.Primitives

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.3%
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
CoreWCF · CoreWCF
CVEs relacionadas — CoreWCF

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54772HIGHCoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshakeEPSS 0.8%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2024-28252HIGHCoreWCF NetFraming based services can leave connections open when they should be closedEPSS 0.6%CVE-2026-54779MEDIUMCoreWCF: SAML token replay protection is inoperativeEPSS 0.4%CVE-2026-54782CRITICALCoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validationEPSS 0.4%CVE-2026-54773MEDIUMCoreWCF: WS-Security signature substitution via document-wide Signature lookupEPSS 0.4%