CoreWCF CVE-2026-54784

Exploitation requires the CoreWCF service endpoint to be configured with security mode TransportWithMessageCredential and client credential type Windows, and the binding must use session establishment that triggers WS-SecureConversation - endpoints not using this exact combination are not affected. The attacker must additionally be able to observe the SCT negotiation handshake on the wire, which means the transport must NOT be protected by SSL/TLS (the vendor-confirmed workaround), so TLS-terminated WCF endpoints are effectively shielded. No authentication or user interaction is required (PR:N/UI:N), but the on-path observation requirement is what drives CVSS AC:H, and the window of impact is bounded by the SCT lifetime of approximately 10 hours.

The CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N vector (7.4 High) correctly captures a network-reachable, unauthenticated, high-complexity attack with serious confidentiality and integrity impact and no availability impact - complexity is high because the attacker must be on-path during the SCT negotiation handshake. No EPSS, KEV, or SSVC data was supplied in the input, and no public exploit was identified, so this should be treated as a credible but not actively exploited issue. Real-world risk concentrates in deployments that satisfy the precondition (TransportWithMessageCredential + Windows client credential + session establishment) and that fail to enforce SSL/TLS on the transport, since TLS already mitigates the on-path observation requirement - meaning correctly-configured production WCF endpoints face materially lower risk than the raw CVSS score suggests.

An attacker positioned on the network path between a WCF client and a CoreWCF service - for example via ARP spoofing on a shared LAN, a compromised intermediate proxy, or an unencrypted hop - passively captures the SPNEGO RSTR during SCT negotiation and extracts the unwrapped proof key. Using that key the attacker derives the session keys, then either decrypts subsequent WS-SecureConversation messages or forges new ones that the server accepts as the authenticated Windows principal for up to ~10 hours. No public exploit identified at time of analysis, but the cryptographic primitive is straightforward once the handshake is captured.