CVE-2026-26221: Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26221?
CVE-2026-26221 is classified as a critical vulnerability due to its potential for remote code execution.
What does CVE-2026-26221 affect?
CVE-2026-26221 affects Hyland OnBase, specifically the Workflow Timer Service and possibly the Workview Timer Service.
How do I fix CVE-2026-26221?
To fix CVE-2026-26221, it is recommended to update to the latest version of Hyland OnBase that addresses this vulnerability.
Can CVE-2026-26221 be exploited without authentication?
Yes, CVE-2026-26221 can be exploited without authentication, allowing attackers to potentially execute arbitrary code.
What are the potential impacts of CVE-2026-26221?
The potential impacts of CVE-2026-26221 include unauthorized remote code execution, which can lead to data breaches and system compromise.