CVE-2026-39906CRITICAL 10.0EPSS p47.8%

CVE-2026-39906CVE-2026-39906

Description

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.

Scoring

CVSS 3.110.0 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS0.69% probability of exploitation · percentile 47.8% · 2026-06-19T12:03:05Z
Published2026-04-14
Last modified2026-05-06

Underlying weaknesses· 1

CWE-441

References

  1. https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129
  2. https://www.unisys.com/solutions/cai/applications/
  3. https://www.vulncheck.com/advisories/unisys-webperfect-image-suite-ntlmv2-hash-leakage-via-net-remoting

1

TypeTargetConfidenceTier
WeaknessUnintended Proxy or Intermediary ('Confused Deputy')cwe-4410%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-39907
CVE
CVE-2026-39908
CVE
CVE-2025-21368
CVE
CVE-2025-21311
CVE
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
CVE
CVE-2026-34909
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.