Altec Doclink
CVE-2026-26222
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to unauth .NET Remoting endpoint
-
ExploitSend crafted serialized object
-
ExecutionTrigger unsafe deserialization
-
ImpactExecute arbitrary code with service privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Altec DocLink version 4.0.336.0 with Altec.RDCHostService.exe exposing doclinkServer.soap ObjectURI over unauthenticated TCP/HTTP without authentication. Default deployment in IIS with writable web-accessible paths required for full impact. |
| Impact | CVSS 9.8, EPSS 1.0%. .NET Remoting deserialization is a well-understood attack vector with mature exploitation tools. |
| Exploit ScenarioDerived | Attacker connects to exposed .NET Remoting TCP endpoint, sends serialized payload that executes arbitrary code when deserialized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthenticated remote code execution via .NET Remoting deserialization attacks.
Earlier versions of this analysis (1)
Insecure .NET Remoting deserialization RCE in Altec DocLink.
RemediationAI
Update DocLink. Migrate from .NET Remoting to WCF or gRPC. Block .NET Remoting TCP ports at the firewall.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-502 deserialization of untrusted data. DocLink exposes .NET Remoting endpoints over TCP without authentication, enabling deserialization attacks.
Know when Altec Doclink gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.
Executive ViewAI
Altec DocLink 4.0.336.0 contains a critical vulnerability (CVSS 9.8) that allows unauthenticated remote attackers to execute arbitrary code through exposed .NET Remoting endpoints. Organizations using this document management system face immediate risk of complete system compromise, data theft, and operational disruption without available vendor patches.
Implement strict network segmentation to restrict TCP and HTTP/SOAP access to the Altec.RDCHostService.exe service. Deploy Web Application Firewall (WAF) rules to block .NET Remoting protocol traffic and doclinkServer.soap requests from unauthorized sources. Disable the vulnerable SOAP endpoint if business operations permit. Monitor network traffic for suspicious ObjectURI requests. Restrict service execution to minimum required user privileges. Consider disabling the DocLink service entirely until patch availability is confirmed and evaluate migration to patched or alternative solutions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB