CVE-2026-26221

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26221", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-11T20:08:07.945Z", "datePublished": "2026-02-13T15:21:48.928Z", "dateUpdated": "2026-05-25T23:41:44.966Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-25T23:41:44.966Z"}, "title": "Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE", "descriptions": [{"lang": "en", "value": "Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host."}]}], "affected": [{"vendor": "Hyland", "product": "OnBase Workflow Timer Service", "modules": ["Hyland.Core.Workflow.NTService.exe"], "versions": [{"status": "affected", "version": "8.0", "lessThanOrEqual": "17.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0", "versionEndIncluding": "17.0.0"}]}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "workarounds": [{"lang": "en", "value": "It is recommended that customers immediately convert to the in-servicing module, Unity Scheduler, and uninstall the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). Starting with OnBase 16, Unity Scheduler is the recommended replacement. It is recommended customers using versions prior to 16 upgrade to an in-servicing release of OnBase and leverage Unity Scheduler.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "It is recommended that customers immediately convert to the in-servicing module, Unity Scheduler, and uninstall the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). Starting with OnBase 16, Unity Scheduler is the recommended replacement. It is recommended customers using versions prior to 16 upgrade to an in-servicing release of OnBase and leverage Unity Scheduler.<br>"}]}], "references": [{"url": "https://www.hyland.com/en/solutions/products/onbase", "tags": ["product"]}, {"url": "https://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03", "tags": ["vendor-advisory", "mitigation", "permissions-required"]}, {"url": "https://www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp.", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "coordinator"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T15:37:28.328195Z", "id": "CVE-2026-26221", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T15:37:35.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26221", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-13T15:37:28.328195Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T15:37:30.868Z"}}], "cna": {"title": "Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp."}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hyland", "modules": ["Hyland.Core.Workflow.NTService.exe"], "product": "OnBase Workflow Timer Service", "versions": [{"status": "affected", "version": "8.0", "versionType": "custom", "lessThanOrEqual": "17.0.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hyland.com/en/solutions/products/onbase", "tags": ["product"]}, {"url": "https://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03", "tags": ["vendor-advisory", "mitigation", "permissions-required"]}, {"url": "https://www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce", "tags": ["third-party-advisory"]}], "workarounds": [{"lang": "en", "value": "It is recommended that customers immediately convert to the in-servicing module, Unity Scheduler, and uninstall the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). Starting with OnBase 16, Unity Scheduler is the recommended replacement. It is recommended customers using versions prior to 16 upgrade to an in-servicing release of OnBase and leverage Unity Scheduler.", "supportingMedia": [{"type": "text/html", "value": "It is recommended that customers immediately convert to the in-servicing module, Unity Scheduler, and uninstall the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). Starting with OnBase 16, Unity Scheduler is the recommended replacement. It is recommended customers using versions prior to 16 upgrade to an in-servicing release of OnBase and leverage Unity Scheduler.<br>", "base64": false}]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.", "supportingMedia": [{"type": "text/html", "value": "Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "17.0.0", "versionStartIncluding": "8.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-25T23:41:44.966Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26221", "state": "PUBLISHED", "dateUpdated": "2026-05-25T23:41:44.966Z", "dateReserved": "2026-02-11T20:08:07.945Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-13T15:21:48.928Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Hyland.Core.Workflow.NTService.exe"], "product": "OnBase Workflow Timer Service", "vendor": "Hyland", "versions": [{"lessThanOrEqual": "17.0.0", "status": "affected", "version": "8.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host."}, {"lang": "es", "value": "Hyland OnBase contiene una exposici\u00f3n de .NET Remoting sin autenticaci\u00f3n en el Servicio de Temporizador de Flujo de Trabajo de OnBase (Hyland.Core.Workflow.NTService.exe). Un atacante que puede alcanzar el servicio puede enviar solicitudes de .NET Remoting manipuladas a los puntos finales de canal HTTP predeterminados en TCP/8900 (p. ej., TimerServiceAPI.rem y TimerServiceEvents.rem para Flujo de Trabajo) para activar la deserializaci\u00f3n insegura de objetos, lo que permite la lectura/escritura arbitraria de archivos. Al escribir contenido controlado por el atacante en ubicaciones accesibles por la web o encadenando con otras caracter\u00edsticas de OnBase, esto puede llevar a la ejecuci\u00f3n remota de c\u00f3digo. La misma primitiva puede ser abusada al proporcionar una ruta UNC para forzar la autenticaci\u00f3n NTLM saliente (coerci\u00f3n SMB) a un host controlado por el atacante."}], "id": "CVE-2026-26221", "lastModified": "2026-06-17T10:25:58.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26221", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T15:37:28.328195Z", "version": "2.0.3"}}]}, "published": "2026-02-13T16:16:11.683", "references": [{"source": "disclosure@vulncheck.com", "url": "https://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03"}, {"source": "disclosure@vulncheck.com", "url": "https://www.hyland.com/en/solutions/products/onbase"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.0,17.0.x]"}}], "product": "onbase_workflow_timer_service", "vendor": "hyland"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "product": "onbase_workview_timer_service", "vendor": "hyland"}], "analysis": {"en": {"generated_at": "2026-04-15T15:13:50.204798+00:00", "value": {"mitigation_remediation": ["Convert immediately to the Unity Scheduler in\u2011servicing module and uninstall the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe).", "Upgrade the OnBase installation to version 16 or later, which recommends the Unity Scheduler and removes the vulnerable timer service.", "If migration has not yet been completed, block or disable inbound traffic on TCP/8900 to eliminate the exposed .NET Remoting endpoint."], "summary": {"action": "Immediate Remediation", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Hyland OnBase Workflow Timer Service, named Hyland:OnBase Workflow Timer Service. No specific product versions were listed in the advisory.", "description_and_impact": "Hyland OnBase allows an unauthenticated attacker to send crafted .NET Remoting requests to the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe) over TCP/8900. The server performs unsafe object unmarshalling, giving the attacker the power to read or write arbitrary files and, by inserting content into web\u2011accessible locations or chaining with other OnBase features, to execute code remotely. The same mechanism can be used to supply a UNC path that coerces the server into performing outbound NTLM authentication to an attacker\u2011controlled SMB host, potentially enabling further compromise. This vulnerability is classified under CWE\u2011502.", "risk_and_exploitability": "The CVSS base score of 9.3 marks this as high severity. The EPSS score is below 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network\u2011directed exploitation of the exposed .NET Remoting endpoint on port 8900, requiring only that the attacker can reach the service. Successful exploitation grants read/write access to critical files and can lead to remote code execution. The risk therefore remains significant for any exposed instance of the Timer Service, even if exploitation is currently rare."}}}}, "created": "2026-02-13T21:28:35.577521+00:00", "updated": "2026-04-15T17:30:10.475562+00:00", "vendors": ["hyland", "hyland$PRODUCT$onbase_workflow_timer_service", "hyland$PRODUCT$onbase_workview_timer_service"]}