PT-2026-7997 · Hyland · Onbase

Vulncheck · Published 2026-02-13 · Updated 2026-02-15 · CVE-2026-26221

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hyland OnBase (affected versions not specified)

Description The software contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe) and the Workview Timer Service. An attacker reaching the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900, such as /TimerServiceAPI.rem and /TimerServiceEvents.rem for Workflow, triggering unsafe object unmarshalling. This enables arbitrary file read and write operations. Writing attacker-controlled content to web-accessible locations or chaining with other OnBase features can lead to remote code execution. Supplying a UNC path can coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-26221

Affected Products

Onbase

References · 10

• https://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03 · Vendor Advisory
• https://community.hyland.com/resources/bulletins-and-notices/210540-security-update-hyland-timer-service-bulletin-ob2025-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26221 · Security Note
• https://hyland.com/en/solutions/products/onbase · Note
• https://twitter.com/0dayPublishing/status/2023156546834661769 · Twitter Post
• https://t.me/CVEtracker/44622 · Telegram Post
• https://twitter.com/offseq/status/2022551437671010456 · Twitter Post
• https://twitter.com/vuldb/status/2022714262670708966 · Twitter Post
• https://twitter.com/vuldb/status/2022362947411235262 · Twitter Post
• https://vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce · Note