Which versions of Kofax Capture are affected by CVE-2026-23751?

Kofax Capture (Tungsten Capture) version 6.0.0.0 contains a critical unauthenticated vulnerability in a legacy .NET Remoting HTTP channel that enables attackers to read/write files, steal NTLM…

Is there a public PoC exploit available for CVE-2026-23751?

Yes, a public proof-of-concept exploit is available for CVE-2026-23751. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-23751?

Within 24 hours: Verify whether Kofax Capture 6.0.0.0 is deployed in your environment and identify all affected systems; document the service account privileges for each Kofax Capture Service instance. Within 7 days: Implement firewall rules to restrict inbound access to TCP/2424 to only trusted administrative networks; assess whether the deprecated .NET Remoting HTTP channel can be disabled without impacting operations. Within 30 days: Subscribe to Kofax security advisories for patch availability and develop an upgrade plan to a patched version; implement network segmentation to isolate affected systems from untrusted network segments.

Kofax Capture CVE-2026-23751

Q: What is the CVSS score of CVE-2026-23751?

CVE-2026-23751 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25228 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-23 VulnCheck

GHSA-pc62-x5ww-3xm5

Authentication Bypass RCE Denial Of Service Kofax Capture

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity access to an unauthenticated .NET Remoting endpoint (AV:N/AC:L/PR:N/UI:N) yields file read/write and potential RCE/DoS, giving high C/I/A; scope unchanged as impact stays within the service host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:46 vuln.today

PoC Detected

Apr 24, 2026 - 14:50 vuln.today

Public exploit code

CVSS changed

Apr 23, 2026 - 16:27 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 16:00 euvd

EUVD-2026-25228

CVE Published

Apr 23, 2026 - 14:46 nvd

CRITICAL 9.3

DescriptionCVE.org

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling techniques to instantiate a remote System.Net.WebClient object and read arbitrary files from the server filesystem, write attacker-controlled files to the server, or coerce NTLMv2 authentication to an attacker-controlled host, enabling sensitive credential disclosure, denial of service, remote code execution, or lateral movement depending on service account privileges and network environment.

AnalysisAI

Unauthenticated remote file read/write and NTLM coercion in Kofax Capture (rebranded Tungsten Capture) 6.0.0.0 stems from the Ascent Capture Service exposing a deprecated .NET Remoting HTTP channel on TCP/2424 with a default, publicly known endpoint identifier and no authentication. A remote attacker can abuse .NET Remoting object unmarshalling to instantiate a server-side System.Net.WebClient, allowing arbitrary file read/write and coerced NTLMv2 authentication that can cascade into credential theft, denial of service, remote code execution, or lateral movement depending on the service account's privileges. Publicly available exploit code exists (VulnCheck/gist PoC); it is not listed in CISA KEV, and EPSS is low at 0.16% (37th percentile).

Technical ContextAI

.NET Remoting is a legacy Microsoft RPC framework whose HTTP/binary channels deserialize (unmarshal) remote object references; when a well-known endpoint is reachable without authentication, an attacker can force the server to instantiate arbitrary marshal-by-reference types such as System.Net.WebClient, a classic .NET Remoting object-unmarshalling attack class Microsoft has deprecated precisely because it is unsafe to expose. Here the Ascent Capture Service (the core document-capture service of Kofax/Tungsten Capture) binds this channel on port 2424 with a default, publicly known endpoint name. The root cause maps to CWE-306 (Missing Authentication for Critical Function): a security-sensitive service interface is exposed with no authentication gate. The affected component is identified by CPE cpe:2.3:a:tungsten_automation:kofax_capture, confirming the Tungsten Automation (formerly Kofax) Capture product line.

RemediationAI

No vendor-released patched version is independently confirmed in the available data, so treat remediation as compensating-control driven until Tungsten Automation publishes a fixed build (monitor the vendor advisory portal at https://docshield.tungstenautomation.com and the VulnCheck advisory). The most direct control is to block or firewall inbound access to TCP port 2424 on Ascent Capture Service hosts, restricting it to trusted management networks only - this severs the remote attack path with minimal functional impact if remote clients do not require that legacy channel. Where feasible, disable the deprecated .NET Remoting HTTP channel or restrict the Ascent Capture Service to internal segments, and run the service under a least-privileged account (not a domain admin or highly privileged service account) to limit the blast radius of coerced NTLMv2 authentication and potential RCE. To blunt NTLM relay/coercion, enforce SMB signing and channel binding/EPA and egress-filter outbound SMB (445) from capture servers, accepting that strict SMB signing can add overhead and break legacy integrations. Validate any interim controls do not disrupt legitimate capture-client connectivity before broad rollout.