CVE-2026-26221

Summary

Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.

Affected Software

VendorProductVersion RangeStatus
HylandOnBase Workflow Timer Service8.0 <= 17.0.0affected

Weaknesses

  • CWE-502: CWE-502 Deserialization of Untrusted Data

Workarounds

It is recommended that customers immediately convert to the in-servicing module, Unity Scheduler, and uninstall the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). Starting with OnBase 16, Unity Scheduler is the recommended replacement. It is recommended customers using versions prior to 16 upgrade to an in-servicing release of OnBase and leverage Unity Scheduler.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References