Alfresco Transform Core
CVE-2026-26339
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Remote code execution in Hyland's Alfresco Transform Service (and the related Alfresco Transform Core component) lets unauthenticated network attackers inject crafted arguments into the document-processing pipeline to run arbitrary commands on the transformation host. Any exposed Alfresco deployment relying on these transform components is affected, with no login required and full compromise of confidentiality, integrity and availability. No public exploit has been identified at time of analysis, and the EPSS probability is currently low (0.22%, 44th percentile).
Earlier versions of this analysis (1)
Argument injection RCE in Alfresco Transformation Service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Alfresco Transform Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.
Executive ViewAI
Hyland's Alfresco Transform Service contains a critical unauthenticated remote code execution vulnerability (CVE-2026-26339, CVSS 9.3) affecting any exposed deployment. Attackers can execute arbitrary commands on transformation servers without authentication, compromising confidentiality, integrity, and availability of document processing infrastructure. Organizations using Alfresco must immediately assess external exposure and implement compensating controls, as no vendor patch is currently available.
Within 24 hours: inventory all Alfresco Transform Service and Transform Core deployments, determine which are internet-exposed or accessible from untrusted networks, and immediately assess whether network isolation is feasible. Within 7 days: isolate affected servers from the internet via firewall rules or network segmentation, restrict Transform Service API access to authenticated internal clients only, and enable detailed logging on all transform endpoints for forensic review. Within 30 days: coordinate directly with Hyland on patch timeline and availability roadmap; establish a phased upgrade plan; monitor Hyland security advisories for patch release; and conduct full remediation testing before production deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict Transform Service access to internal networks only; block all inbound internet connections to transformation servers. (2) API gateway authentication-require authenticated requests via reverse proxy before reaching Transform Service. (3) Process isolation-run Transform Service under least-privilege OS accounts with minimal file/system access. (4) Audit logging-enable verbose logging of all transformation requests and command-line arguments for detection. (5) Input validation-implement strict allowlisting of document types and file paths at the API boundary. These controls reduce but do not eliminate risk; vendor patch is required for full remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB