Which versions of Alfresco Transform Core are affected by CVE-2026-26339?

Hyland's Alfresco Transform Service contains a critical unauthenticated remote code execution vulnerability (CVE-2026-26339, CVSS 9.3) affecting any exposed deployment.

How to fix or mitigate CVE-2026-26339?

Within 24 hours: inventory all Alfresco Transform Service and Transform Core deployments, determine which are internet-exposed or accessible from untrusted networks, and immediately assess whether network isolation is feasible. Within 7 days: isolate affected servers from the internet via firewall rules or network segmentation, restrict Transform Service API access to authenticated internal clients only, and enable detailed logging on all transform endpoints for forensic review. Within 30 days: coordinate directly with Hyland on patch timeline and availability roadmap; establish a phased upgrade plan; monitor Hyland security advisories for patch release; and conduct full remediation testing before production deployment.

Alfresco Transform Core CVE-2026-26339

Q: What is the CVSS score of CVE-2026-26339?

CVE-2026-26339 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-19 disclosure@vulncheck.com

RCE Alfresco Transform Core Alfresco Transform Service SSRF

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 19:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 19:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 18:25 nvd

CRITICAL 9.8

DescriptionCVE.org

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

AnalysisAI

Remote code execution in Hyland's Alfresco Transform Service (and the related Alfresco Transform Core component) lets unauthenticated network attackers inject crafted arguments into the document-processing pipeline to run arbitrary commands on the transformation host. Any exposed Alfresco deployment relying on these transform components is affected, with no login required and full compromise of confidentiality, integrity and availability. No public exploit has been identified at time of analysis, and the EPSS probability is currently low (0.22%, 44th percentile).