CVE-2026-26222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26222", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-11T20:08:07.945Z", "datePublished": "2026-02-24T17:33:12.136Z", "dateUpdated": "2026-02-27T20:53:32.186Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Altec DocLink", "vendor": "Beyond Limits Inc.", "versions": [{"status": "affected", "version": "4.0.336.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp"}, {"lang": "en", "type": "finder", "value": "Omar Crespo, Pentester, GM Sectec, Corp"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI \"doclinkServer.soap\". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite."}], "value": "Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI \"doclinkServer.soap\". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-02-24T17:36:46.668Z"}, "references": [{"tags": ["product"], "url": "https://doclinkai.com/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/doclink-net-remoting-unauthenticated-arbitrary-file-read-write-rce"}], "source": {"discovery": "EXTERNAL"}, "title": "DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T20:53:23.856280Z", "id": "CVE-2026-26222", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T20:53:32.186Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T20:53:23.856280Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T20:53:28.836Z"}}], "cna": {"title": "DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp"}, {"lang": "en", "type": "finder", "value": "Omar Crespo, Pentester, GM Sectec, Corp"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Beyond Limits Inc.", "product": "Altec DocLink", "versions": [{"status": "affected", "version": "4.0.336.0"}], "defaultStatus": "unknown"}], "references": [{"url": "https://doclinkai.com/", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/doclink-net-remoting-unauthenticated-arbitrary-file-read-write-rce", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI \"doclinkServer.soap\". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.", "supportingMedia": [{"type": "text/html", "value": "Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI \"doclinkServer.soap\". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-02-24T17:36:46.668Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26222", "state": "PUBLISHED", "dateUpdated": "2026-02-27T20:53:32.186Z", "dateReserved": "2026-02-11T20:08:07.945Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-24T17:33:12.136Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Altec DocLink", "vendor": "Beyond Limits Inc.", "versions": [{"status": "affected", "version": "4.0.336.0"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:beyond:altec_doclink:4.0.336.0:*:*:*:*:*:*:*", "matchCriteriaId": "115440AE-8BBE-4377-BF90-A2C0A69897D1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI \"doclinkServer.soap\". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite."}, {"lang": "es", "value": "Altec DocLink (ahora mantenido por Beyond Limits Inc.) versi\u00f3n 4.0.336.0 expone endpoints inseguros de .NET Remoting sobre TCP y HTTP/SOAP a trav\u00e9s de Altec.RDCHostService.exe usando el ObjectURI 'doclinkServer.soap'. El servicio no requiere autenticaci\u00f3n y es vulnerable a la deserializaci\u00f3n insegura de objetos, permitiendo a atacantes en remoto leer archivos arbitrarios del sistema subyacente especificando rutas de archivos locales. Adem\u00e1s, los atacantes pueden forzar la autenticaci\u00f3n SMB a trav\u00e9s de rutas UNC y escribir archivos arbitrarios en ubicaciones del servidor. Debido a que las rutas escribibles pueden ser accesibles por web bajo IIS, esto puede resultar en ejecuci\u00f3n remota de c\u00f3digo no autenticada o denegaci\u00f3n de servicio mediante la sobrescritura de archivos."}], "id": "CVE-2026-26222", "lastModified": "2026-06-17T10:25:58.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26222", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T20:53:23.856280Z", "version": "2.0.3"}}]}, "published": "2026-02-24T18:29:33.293", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://doclinkai.com/"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.vulncheck.com/advisories/doclink-net-remoting-unauthenticated-arbitrary-file-read-write-rce"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0.336.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Altec DocLink", "source": "cna", "vendor": "Beyond Limits Inc."}, "product": "altec_doclink", "vendor": "beyond_limits"}], "analysis": {"en": {"generated_at": "2026-04-16T16:22:00.511415+00:00", "value": {"mitigation_remediation": ["Apply the vendor supplied patch or upgrade Altec DocLink to a version that removes or protects the .NET Remoting endpoints.", "If an immediate patch is unavailable, stop or disable the Altec.RDCHostService.exe process or remove the 'doclinkServer.soap' object URI from the configuration to eliminate the unauthenticated entry point.", "Restrict network access to the ports and hosts used by Altec.RDCHostService.exe using firewall rules or segmentation, ensuring that only trusted internal hosts can reach the service."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution via Arbitrary File Read/Write"}, "threat_synthesis": {"affected_systems": "Beyond Limits Inc. maintains Altec DocLink. The affected product is Altec DocLink version 4.0.336.0. No other versions are listed as affected in the CNA data. The product is typically deployed in environments where the Altec.RDCHostService.exe process listens for .NET Remoting traffic on standard TCP/HTTP ports and exposes SOAP endpoints.", "description_and_impact": "Altec DocLink version 4.0.336.0 exposes unauthenticated .NET Remoting endpoints accessed through TCP or HTTP/SOAP. The service, Altec.RDCHostService.exe, binds to the object URI 'doclinkServer.soap' and performs unsafe object unmarshalling. This allows a remote actor to specify any file path on the underlying system, read its contents, or write data to arbitrarily chosen locations, including paths that are publicly reachable under IIS. A write to such locations can overwrite web\u2011executable files and give the attacker the ability to execute code on the server, or cause denial of service by corrupting critical files. The vulnerability is a classic instance of unsafe deserialization (CWE\u2011502) and can be leveraged without authentication, leading to full remote code execution.", "risk_and_exploitability": "The CVSS score of 10 indicates maximum severity, and the EPSS score of 1% reflects a non\u2011negligible likelihood of exploitation. It is not listed in the CISA KEV catalog, but the presence of unauthenticated access and deserialization flaws strongly suggests that attackers could target the service over the public internet. The likely attack vector involves a remote actor connecting to the vulnerable TCP or HTTP endpoints, crafting a malicious payload that exploits the deserialization process to read or overwrite files and thereby achieve remote code execution."}}}}, "created": "2026-02-25T11:35:50.315994+00:00", "updated": "2026-04-16T16:30:15.934690+00:00", "vendors": ["beyond_limits", "beyond_limits$PRODUCT$altec_doclink"]}