CVE-2026-39906
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement.
Risk Assessment
An attacker can obtain NTLMv2 machine-account hashes, which can be used for privilege escalation or lateral movement within the network, compromising the entire domain.
Recommendation
Immediately upgrade Unisys WebPerfect Image Suite to a version that does not contain this vulnerability, or disable the deprecated .NET Remoting channel if possible.
Original NVD description (English source)
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.