Webperfect Image Suite CVE-2026-39906

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 with deprecated .NET Remoting TCP channel enabled. Remote unauthenticated attacker supplies Windows UNC path via object-unmarshalling to trigger NTLMv2 machine-account hash leakage. No victim interaction required.

Real-world risk is HIGH despite moderate CVSS 7.0 scoring. The CVSS 4.0 vector reveals critical attack characteristics: network-based (AV:N), low complexity (AC:L), no privileges required (PR:N), and high subsequent system confidentiality/integrity impact (SC:H/SI:H), indicating scope change attacks where initial compromise enables broader network access. The attack complexity-present (AT:P) modifier suggests environmental dependencies (network configuration, SMB signing policies), but these conditions are common in enterprise environments. While no public exploit is identified, the VulnCheck advisory provides detailed technical disclosure enabling rapid weaponization. The unauthenticated remote attack vector combined with credential theft-enabling pivot attacks rather than single-host compromise-elevates this beyond typical information disclosure. NTLM relay attacks remain highly effective in Windows environments with mixed patch levels or legacy authentication requirements. Organizations running affected versions face immediate risk of network-wide compromise if the vulnerable service is network-accessible.

An external attacker scans for exposed Unisys WebPerfect Image Suite instances and identifies the .NET Remoting TCP channel. The attacker crafts a malicious serialized object containing a UNC path pointing to their controlled SMB listener (e.g., \\attacker.com\capture), then sends it to the Remoting endpoint. The application server automatically attempts NTLM authentication to the attacker's server, leaking the machine account's NTLMv2 hash. The attacker relays this hash to a domain controller or file server lacking SMB signing, authenticating as the compromised machine account to access sensitive shares, execute code via scheduled tasks, or escalate privileges within the Active Directory domain.