Hyland OnBase Timer Services Unauthenticated .NET Remoting RCE_CVE-2026-26221

{
    "lastseen": "",
    "description": "Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe) and is also reported by the vendor to impact the Workview Timer Service (an impacted version range is undefined). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.",
    "published": "2026-02-13T15:21:48.928Z",
    "modified": "2026-02-13T15:37:35.046Z",
    "type": "cve",
    "title": "Hyland OnBase Timer Services Unauthenticated .NET Remoting RCE",
    "source": "VulnCheck",
    "references": "https://www.hyland.com/en/solutions/products/onbase\nhttps://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03\nhttps://community.hyland.com/resources/bulletins-and-notices/210540-security-update-hyland-timer-service-bulletin-ob2025-02\nhttps://www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce",
    "id": "CVE-2026-26221",
    "bulletinFamily": "",
    "cwe": [
        "CWE-502"
    ],
    "cvelist": null,
    "sourceData": "Hyland OnBase Workflow Timer Service 8.0\nHyland OnBase Workview Timer Service 0",
    "sourceHref": "",
    "cvss": {
        "score": 10,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "OnBase Workflow Timer Service",
    "version": "8.0",
    "vendor": "Hyland",
    "ai_description": "Unauthenticated .NET Remoting exposure in OnBase Workflow Timer Service and Workview Timer Service, enabling arbitrary file read/write and potential remote code execution.",
    "ai_severity": "Critical",
    "ai_vendor": "Hyland",
    "ai_product": "OnBase Workflow Timer Service, OnBase Workview Timer Service",
    "ai_version": "8.0, 0",
    "ai_score": 10
}