On the same week that distributed key manager ACL enforcement activated across custodian HSM clusters, two spoofing-class vulnerabilities were published against the federated signer gateway that sits in front of every withdrawal approval. CVSS 7.5 and 7.4. Neither requires privileged access. Both shipped inside a batch of fifteen signer-infrastructure CVEs released in a single disclosure cycle.
There is no public proof of concept. No CISA KEV listing. No on-chain evidence of exploitation.
That contradiction is the story. High severity, zero proof, and a hardening mechanism that went live the same week the attack surface reopened. A single line of logic can unravel a thousand lies โ so follow the logic before you follow the headline.
To understand why this matters, you have to understand where signing actually happens in institutional crypto custody.
A custodian does not let a human press a button that moves 500 BTC. The path is layered: an operator authenticates through a federated identity bridge, typically SAML 2.0 or OIDC; the bridge issues an assertion; the assertion becomes a session; the session is mapped to a signing policy; the policy authorizes a threshold signature across an HSM cluster. Every layer inherits the trust of the layer beneath it.
The signer gateway is the broker. It assumes โ as a design premise, not as a checked condition โ that the assertion signature was verified before the session was established. That assumption is the load-bearing strut of the entire chain. Remove it and nothing above it means anything.
This is not theoretical. Golden SAML was documented in 2017 and deployed against SolarWinds in 2020. The technique is unchanged in principle: forge the assertion, never touch the private key. You do not need to steal the signing key if you can become the entity the signing policy trusts.
The DKM โ distributed key manager โ protects the token-signing certificate. ACL enforcement restricts who can read the DKM container. That is what activated this month.
Here is where the architecture breaks, and where the disclosure narrative breaks with it.
The federated trust model places the integrity of the entire chain on one condition: that signature verification executed correctly. There is no second check. There is no continuous re-evaluation after session establishment. If the verification layer is bypassed โ or if the token-signing certificate is extracted and used to mint a valid assertion โ every downstream authorization decision inherits the forgery. This is not a bug inside a product. It is the protocol's single-point trust model, and it is not patchable at the configuration layer.
That distinction is the core of the problem, and the disclosure blurs it.
DKM ACL enforcement constrains who can read the key container. It does not repair assertion-forgery logic. The published material concedes this: the vulnerabilities affect authentication and authorization independently of DKM state. Read that sentence twice. If enforcement cannot close the flaw, then "enforcement activated" and "two new spoofing CVEs" are not causally linked. They are two facts placed side by side to manufacture a narrative of inevitability. The narrative is emotionally satisfying. It is not analytically sound.
The more useful signal is privilege level. Neither CVE requires elevated access. A standard domain user โ in custody terms, a read-only operator account with console access โ can initiate the chain that terminates in signing authority. That is a lateral-movement and privilege-escalation profile, and CVSS 7.5 materially undersells it. Severity scores measure exploit complexity in the abstract. They do not measure what happens when the compromised asset is a signer.
The counterweight is real, and I will not pretend otherwise. No proof of concept. No KEV entry. No observed exploitation. In my own forensic work, absence of exploitation evidence is a hard data point, and it should cap urgency.
But the batch itself deserves scrutiny. Fifteen signer-infrastructure CVEs in one cycle reads two ways. Charitable reading: a concentrated security audit. Realistic reading: a vulnerability backlog released at once. Legacy identity assets โ on-premises federation bridges that vendors quietly deprioritized while steering customers toward cloud identity platforms โ accumulate debt structurally. Patch volume is the interest payment, not the audit.
Then there is the verification gap, the most underrated operational risk in this cycle. Compliance frameworks require patching high-severity issues inside thirty days. Almost none require proving that configuration enforcement actually took effect on every node. You can be fully patched and fully exposed at the same time. The custody equivalent is familiar to anyone who has audited signing infrastructure: keys rotated, ACLs stale; threshold shares reissued, old recovery shards still live in a secondary region. The patch shipped. The hole did not close.
A forensic caveat I cannot omit. The CVE identifiers here are six digits โ CVE-2026-108131 and CVE-2026-96222 โ and the source material cites only internal post numbers, 131823 and 131832, with no attributable publisher, no author, no outlet. I could not locate either identifier in NVD or in the vendor's own security response center. Code doesn't lie. Whitepapers do. Treat these as claims, not facts, until they survive independent confirmation.
The bulls have a point, and it deserves stating cleanly.
Their argument: no PoC, no KEV, no exploitation means the alarm is theater โ content marketing wrapped in a severity score. They are half right. Absence of exploitation evidence is a genuine signal, and treating every Important-rated CVE as an emergency produces the patch fatigue that buries the real criticals. Fifteen items in one disclosure window dilutes attention per item. That is narrative management, intentional or not.
What they miss is that urgency and exposure are different variables. A vulnerability with no public exploit can still sit on a structural flaw no patch cycle reaches. Migration to continuous verification โ session signals, re-evaluation after establishment, CAEP-style shared signals โ is the actual remediation, and custodians that replaced the federated session broker with hardware-bound threshold signing never carried this exposure to begin with. That is the architectural answer, and it is not on any Patch Tuesday calendar.
There is a second blind spot worth naming. Security vendors weaponize each other's CVE counts. The on-premises-is-unsafe pitch has run for years and survived the 2023 cloud identity breach intact, because comparative rot is not a security argument. Cold eyes see what warm hearts ignore: the question is never whose product has more CVEs. It is where the trust actually terminates.
The question is not whether these two CVEs are real. The question is whether your signer gateway still trusts an assertion because a signature check ran once, at session establishment, and never again. If the answer is yes, you are carrying a structural deficit that no patch cycle closes โ and no severity score will tell you.