What is the CVSS score of CVE-2026-26336?

CVE-2026-26336 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Alfresco Content Services are affected by CVE-2026-26336?

Hyland Alfresco installations are vulnerable to unauthenticated file disclosure attacks that could expose sensitive configuration files, database credentials, and system secrets stored in protected…

How to fix or mitigate CVE-2026-26336?

Within 24 hours: Identify all Alfresco instances in your environment and validate exposure by testing the /share/page/resource/ endpoint from external networks. Within 7 days: Implement network-level access controls restricting external access to the Alfresco application or deploy WAF rules blocking requests to the vulnerable endpoint. Within 30 days: Rotate all credentials and secrets potentially exposed in WEB-INF directories (database passwords, API keys, encryption keys) and conduct a full audit of accessed files in application logs.

Alfresco Content Services CVE-2026-26336

HIGH

Incorrect Authorization (CWE-863)

2026-02-19 disclosure@vulncheck.com

Authentication Bypass Information Disclosure Alfresco Content Services

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 17:24 nvd

HIGH 7.5

DescriptionCVE.org

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.

AnalysisAI

Unauthenticated attackers can bypass access controls in Alfresco Content Services to retrieve sensitive files from protected directories such as WEB-INF through the /share/page/resource/ endpoint. This vulnerability exposes critical configuration data and credentials without requiring authentication or user interaction. No patch is currently available for this remotely exploitable issue affecting Alfresco deployments.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Alfresco Content Services. Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.