CCoreWCF

Products

Exploited and recent CVEs

• CVE-2026-54782 Critical 10.0 CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation 0.4%
• CVE-2026-54781 High 7.4 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced 0.2%
• CVE-2026-54784 High 7.4 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality 0.3%
• CVE-2026-54774 High 7.4 CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate 0.2%
• CVE-2026-54783 High 7.4 CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages 0.2%
• CVE-2026-54780 Low 3.7 CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass 0.2%
• CVE-2026-54775 Medium 6.5 CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service. 0.6%
• CVE-2026-54778 Medium 6.2 CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution 0.1%
• CVE-2026-54773 Medium 5.9 CoreWCF: WS-Security signature substitution via document-wide Signature lookup 0.4%
• CVE-2026-54779 Medium 5.9 CoreWCF: SAML token replay protection is inoperative 0.4%
• CVE-2026-54772 High 7.5 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake 0.8%
• CVE-2026-54776 Medium 4.4 CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade 0.2%
• CVE-2026-54777 Medium 6.5 CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance 0.1%
• CVE-2024-28252 High 7.5 CoreWCF NetFraming based services can leave connections open when they should be closed 0.6%