PT-2026-21572 · Fiserv · Fiserv Originate Loans Peripherals

Vulncheck · Published 2026-02-23 · Updated 2026-02-24 · CVE-2026-21665

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fiserv Originate Loans Peripherals version 2021.2.4 (build 4.7.3155.0011)

Description The Print Service component of Fiserv Originate Loans Peripherals utilizes deprecated .NET Remoting TCP channels that permit unsafe deserialization of untrusted data. In client-managed deployments where these services are accessible on an untrusted network, an unauthenticated attacker could potentially achieve remote code execution. This issue was observed in a client-hosted deployment with .NET Remoting ports exposed to an untrusted network, which is not a default or supported configuration.

Recommendations Upgrade to a currently supported release (2025.1 or later). Ensure that .NET Remoting service ports are not exposed beyond trusted network boundaries.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-21665

Affected Products

Fiserv Originate Loans Peripherals

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-21665 · Security Note
• https://twitter.com/CVEnew/status/2026184673232343482 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026089852911997147 · Twitter Post
• https://learn.microsoft.com/en-us/dotnet/core/compatibility/core-libraries/5.0/remoting-apis-obsolete · Note
• https://t.me/CVEtracker/45538 · Telegram Post