CVE-2026-26338

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26338", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-13T17:28:43.053Z", "datePublished": "2026-02-19T17:03:23.521Z", "dateUpdated": "2026-07-28T01:48:26.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:26.969Z"}, "title": "Hyland Alfresco Transformation Service SSRF", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality."}], "value": "Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "modules": ["ATS"], "product": "Alfresco Transformation Service (Enterprise)", "vendor": "Hyland", "versions": [{"lessThan": "4.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:github/Alfresco/alfresco-transform-core", "modules": ["Transform Core AIO"], "product": "Alfresco Community (Transform Core)", "repo": "https://github.com/Alfresco/alfresco-transform-core", "vendor": "Hyland", "versions": [{"lessThan": "5.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:transformation_advisor:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.3.0"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551"}, {"tags": ["product"], "url": "https://www.hyland.com/en/solutions/products/alfresco-platform"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-ssrf"}], "credits": [{"lang": "en", "type": "finder", "value": "Piotr Bazydlo (@chudyPB) of watchTowr"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T19:10:14.020075Z", "id": "CVE-2026-26338", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T19:11:04.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26338", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T19:10:14.020075Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T19:10:51.596Z"}}], "cna": {"title": "Hyland Alfresco Transformation Service SSRF", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Piotr Bazydlo (@chudyPB) of watchTowr"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hyland", "modules": ["ATS"], "product": "Alfresco Transformation Service (Enterprise)", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/Alfresco/alfresco-transform-core", "vendor": "Hyland", "modules": ["Transform Core AIO"], "product": "Alfresco Community (Transform Core)", "versions": [{"status": "affected", "version": "0", "lessThan": "5.3.0", "versionType": "semver"}], "packageURL": "pkg:github/Alfresco/alfresco-transform-core", "defaultStatus": "unaffected"}], "references": [{"url": "https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551", "tags": ["vendor-advisory", "patch"]}, {"url": "https://www.hyland.com/en/solutions/products/alfresco-platform", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-ssrf", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.", "supportingMedia": [{"type": "text/html", "value": "Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:transformation_advisor:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.3.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:26.969Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26338", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:48:26.969Z", "dateReserved": "2026-02-13T17:28:43.053Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-19T17:03:23.521Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["ATS"], "product": "Alfresco Transformation Service (Enterprise)", "vendor": "Hyland", "versions": [{"lessThan": "4.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "modules": ["Transform Core AIO"], "packageURL": "pkg:github/Alfresco/alfresco-transform-core", "product": "Alfresco Community (Transform Core)", "repo": "https://github.com/Alfresco/alfresco-transform-core", "vendor": "Hyland", "versions": [{"lessThan": "5.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hyland:alfresco_transform_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AFF4310-3BA6-40A0-8609-388233D68447", "versionEndExcluding": "4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hyland:alfresco_transform_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0151795-79BD-4D1C-AD6D-92AA77AF3200", "versionEndExcluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hyland:alfresco_transform_core:5.3.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "3C234CF3-DCAF-4A0C-93B5-82BFFE7EF5AD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality."}, {"lang": "es", "value": "Hyland Alfresco Transformation Service permite a atacantes no autenticados lograr falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de la funcionalidad de procesamiento de documentos."}], "id": "CVE-2026-26338", "lastModified": "2026-07-14T16:17:00.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26338", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T19:10:14.020075Z", "version": "2.0.3"}}]}, "published": "2026-02-19T18:24:59.930", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://www.hyland.com/en/solutions/products/alfresco-platform"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-ssrf"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Alfresco Community (Transform Core)", "source": "cna", "vendor": "Hyland"}, "product": "alfresco_community", "vendor": "hyland"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Alfresco Transformation Service (Enterprise)", "source": "cna", "vendor": "Hyland"}, "product": "alfresco_transformation_service", "vendor": "hyland"}], "analysis": {"en": {"generated_at": "2026-04-16T16:54:41.230546+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied security patch for Hyland Alfresco Transformation Service and Transform Core.", "Configure network segmentation to restrict outbound traffic from the Transformation Service to only approved destinations, blocking access to sensitive internal IP ranges.", "Disable or limit unauthenticated access to document processing endpoints, ensuring only authorized users can invoke the service."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability afflicts Hyland Alfresco Community (Transform Core) and Hyland Alfresco Transformation Service (Enterprise). No specific version is enumerated; the flaw applies to all released instances of the affected components.", "description_and_impact": "Hyland Alfresco Transformation Service enables an unauthenticated attacker to perform server\u2011side request forgery through its document processing functionality. By manipulating the request, the attacker can instruct the service to fetch arbitrary URLs, potentially accessing sensitive internal resources, external services, or performing reconnaissance on the internal network. This flaw enables the attacker to breach confidentiality, disrupt services, or further pivot within the environment.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a moderate to high severity, yet the Exploit Prediction Scoring System rate is below 1%, implying a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote network\u2011based, leveraging unauthenticated HTTP endpoints for triggering SSRF. Without immediate remediation, the flaw presents a tangible risk of internal data leakage and potential service disruption."}}}}, "created": "2026-02-20T10:06:18.504109+00:00", "updated": "2026-04-16T17:00:09.384189+00:00", "vendors": ["hyland", "hyland$PRODUCT$alfresco_community", "hyland$PRODUCT$alfresco_transformation_service"]}