PT-2026-32938 · Unisys · Webperfect Image Suite

Vulncheck · Published 2026-04-14 · Updated 2026-05-06 · CVE-2026-39907

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unisys WebPerfect Image Suite version 3.0.3960.22810 Unisys WebPerfect Image Suite version 3.0.3960.22604

Description An unauthenticated WCF SOAP endpoint on TCP port 1208 accepts unsanitized file paths in the LFName parameter of the 'ReadLicense' action. This allows remote attackers to submit crafted SOAP requests containing UNC paths, forcing the server to initiate outbound SMB connections. This process leaks NTLMv2 machine-account hashes, which can be relayed for privilege escalation or lateral movement within the network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-39907

Affected Products

Webperfect Image Suite

References · 7

• 🔥 https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39907 · Security Note
• https://t.me/cveNotify/162348 · Telegram Post
• https://unisys.com/solutions/cai/applications · Note
• https://vulncheck.com/advisories/unisys-webperfect-image-suite-ntlmv2-hash-leakage-via-wcf-soap · Note
• https://twitter.com/CVEnew/status/2044338923292525027 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044292741610271092 · Twitter Post