Is CVE-2026-54782 actively exploited?

No active exploitation of CVE-2026-54782 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-54782 be exploited remotely?

Yes. CVE-2026-54782 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-54782?

CVE-2026-54782 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-54782

CRITICAL

CVE-2026-54782

CWE-290Published: July 8, 2026· Updated: Jul 10, 2026

10.0

CVSS v3.1

EPSS:0.25%probability of exploitation in 30 daysPercentile:15.8th

Official Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

NVD Source

Risk Analysis

This critical vulnerability in CoreWCF allows an unauthenticated remote attacker to impersonate any principal a trusted Security Token Service (STS) could issue. With a perfect CVSS score of 10.0, this flaw represents an extremely severe risk to authentication and authorization mechanisms. The issue stems from incorrect SAML token validation.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable without authentication or user interaction.

Recommended Action

Users of CoreWCF should upgrade to versions 1.8.1 or 1.9.1 to fix this issue. Review and strengthen IdentityConfiguration settings, especially with federated bindings, to ensure proper token validation.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-54782 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.