---
cve: "CVE-2026-26221"
severity: "CRITICAL"
cvss: 9.3
epss: "1.4%"
vendor: "Hyland"
kev: false
exploited: false
published: "2026-02-13 16:16:11"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-22T20:06:04+02:00"
---

# CVE-2026-26221

> 9.3 CRITICAL

## Beschreibung

Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-05-25 23:41:44
- CNA-CVSS: **9.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-502** — Deserialization of Untrusted Data
  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

## Angriffsmuster (CAPEC)

- [CAPEC-586 — Object Injection](https://capec.mitre.org/data/definitions/586.html) _(Severity: High)_

## Referenzen

- <https://www.hyland.com/en/solutions/products/onbase>
- <https://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03>
- <https://www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-26221/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_