CVE-2026-26339

9.3 criticalEPSS 0.6%

Critical (9.3) in hyland. EPSS 0.6% chance of exploitation in the next 30 days.

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-02-19
Modified: 2026-07-14
Record from: the NVD, synced 2026-10-19

Affected

hyland:alfresco_transform_core
hyland:alfresco_transform_service

References

https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551
https://www.hyland.com/en/solutions/products/alfresco-platform
https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-argument-injection-rce

Check your stack JSON