TI-2026-39588 CVE-2026-54782 · GHSA-xjr9-gg9q-jx3v
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
Priority MEDIUM 49
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
CoreWCF
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
CoreWCF records in CISA KEVNo CoreWCF vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2026-39578 CVE-2026-54772 · GHSA-p86g-xrr2-pf7c
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
Priority MEDIUM 40
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2024-18811 CVE-2024-28252 · GHSA-32jq-mv89-5rx7
CoreWCF NetFraming based services can leave connections open when they should be closed
Priority MEDIUM 40
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39590 CVE-2026-54784 · GHSA-2288-8h3r-cqgg
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Priority LOW 34
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39589 CVE-2026-54783 · GHSA-gqv6-pwcg-87r8
Authentication bypass by capture-replay in CoreWCF
Priority LOW 34
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39587 CVE-2026-54781 · GHSA-48pq-2xq3-c2m4
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
Priority LOW 34
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39580 CVE-2026-54774 · GHSA-rpj7-hr7h-w6p9
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
Priority LOW 34
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39583 CVE-2026-54777 · GHSA-6jj2-4q5c-x8g6
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Priority LOW 30
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39581 CVE-2026-54775 · GHSA-m744-jhq9-ppw6
Improper check for unusual conditions in CoreWCF
Priority LOW 30
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39585 CVE-2026-54779 · GHSA-9jr3-rj99-8jq3
CoreWCF: SAML token replay protection is inoperative
Priority LOW 27
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39584 CVE-2026-54778 · GHSA-q6v9-43v5-jv9q
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Priority LOW 27
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39579 CVE-2026-54773 · GHSA-jc6x-rj79-w4mx
CoreWCF: WS-Security signature substitution via document-wide Signature lookup
Priority LOW 27
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39582 CVE-2026-54776 · GHSA-wjpq-6766-7f5j
CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
Priority LOW 19
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.
TI-2026-39586 CVE-2026-54780 · GHSA-4v55-cpmv-3vcm
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
Priority LOW 17
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.