Is CVE-2026-40942 actively exploited?

No active exploitation of CVE-2026-40942 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40942 be exploited remotely?

Yes. CVE-2026-40942 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40942?

CVE-2026-40942 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40942

MEDIUM

CVE-2026-40942

CWE-670Published: April 21, 2026· Updated: Apr 22, 2026

6.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.2th

Official Description

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

NVD Source

Technical Analysis

CVE-2026-40942 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X