CVE-2026-26339

CriticalCVSS 9.8

Published: 19/02/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

42th percentile - higher than 42% of all known CVEs

Summary

A vulnerability in Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through argument injection in the document processing functionality.

Risk Assessment

An attacker can take over the server, access sensitive data, or disrupt the service without requiring authentication.

Recommendation

Apply the vendor-supplied patch immediately and restrict access to the Transformation Service to trusted networks only.

Original NVD description (English source)

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.