CVE-2026-26339

Hyland Alfresco Transformation Service Argument Injection RCE

CVSS 9.3 CRITICALEPSS 0.5%CWE-918

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

19 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

Hyland · Alfresco Community (Transform Core)Hyland · Alfresco Transformation Service (Enterprise)

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551 https://www.hyland.com/en/solutions/products/alfresco-platform https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-argument-injection-rce