Read the docs
TI-2026-21212 Aliases CVE-2026-26221GHSA-5wr5-vxhh-x7gm

Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE

Priority MEDIUM 51CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01331 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HylandOnBase Workflow Timer Service8.0 – 17.0.0—No fix listedCNA
  • OnBase Workflow Timer Service VendorHyland Affected 8.0 – 17.0.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26221
  2. 2026-10-03 Alias added: GHSA-5wr5-vxhh-x7gm

References

Advisory 1

Other 1

  • TI-2025-24307 Hyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE CVSS 4.0CRITICAL 10.0
  • TI-2026-41859 PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service CVSS 4.0CRITICAL 9.3
  • TI-2026-41858 PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service CVSS 4.0CRITICAL 9.3
  • TI-2023-27323 An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. CVSS 3.1HIGH 8.8
  • TI-2024-26898 A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform… CVSS 3.1MEDIUM 6.1
  • TI-2021-12493 Regular expression Denial of Service in MooTools CVSS 3.1MEDIUM 6.1
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences