Read the docs
TI-2026-17448 Aliases CVE-2026-21665GHSA-h68v-wm52-cjcj

Deserialization of untrusted data in Fiserv Originate Loans Peripherals -- Print Service…

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses deprecated .NET Remoting TCP channels that allow unsafe deserialization of untrusted data. When these services are exposed to an untrusted network in a client-managed deployment, an unauthenticated attacker can achieve remote code execution. Version 2021.2.4 is no longer supported by Fiserv. Customers should upgrade to a currently supported release (2025.1 or later) and ensure that .NET Remoting service ports are not exposed beyond trusted network boundaries. This CVE documents behavior observed in a client-hosted deployment running an unsupported legacy version of Originate Loans Peripherals with .NET Remoting ports exposed to an untrusted network. This is not a default or supported configuration. Customers running legacy versions should upgrade to a currently supported release and ensure .NET Remoting ports are restricted to trusted network segments. The finding does not apply to Fiserv-hosted environments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00531 45th percentileScored 2026-11-07
Fix Fixed Originate Loans Peripherals (formerly Velocity Services) -- Print Service component (Fiserv): 2021.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FiservOriginate Loans Peripherals (formerly Velocity Services) -- Print Service component2021.2.4 to before 2021.2.42021.2.4Patch availableCNA
  • Originate Loans Peripherals (formerly Velocity Services) -- Print Service component VendorFiserv Affected 2021.2.4 to before 2021.2.4 Fixed in 2021.2.4 Patch available CNA

Remediation

  • Fix · CNA Originate Loans Peripherals (formerly Velocity Services) -- Print Service component (Fiserv) Fixed in 2021.2.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21665
  2. 2026-10-03 Alias added: GHSA-h68v-wm52-cjcj

References

Other 1

  • TI-2020-18411 Fiserv Prologue through 2020-12-16 does not properly protect the database password. CVSS 3.1MEDIUM 6.5
  • TI-2020-07186 Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter. CVSS 3.1MEDIUM 6.1
  • TI-2020-07185 Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences