EUVD-2026-25228
GHSA-pc62-x5ww-3xm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Ascent Capture Service on TCP/2424
-
DeliverySend crafted .NET Remoting unmarshalling request
-
ExploitInstantiate server-side WebClient object
-
ExecutionRead/write files or coerce NTLMv2 auth
-
PersistRelay hash or write payload
-
ImpactAchieve RCE or lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to TCP port 2424 on a host running the Kofax/Tungsten Capture Ascent Capture Service, which exposes a deprecated .NET Remoting HTTP channel using a default, publicly known endpoint identifier and no authentication - these are the exact preconditions. No credentials, user interaction, or non-default configuration are needed (CVSS 4.0 PR:N/UI:N/AT:N), so any default 6.0.0.0 deployment with that port exposed is exploitable. The primary limiting factor is exposure: this is an internal enterprise document-capture service typically not internet-facing, so real-world risk hinges on whether an attacker already has network access to the segment hosting the service. The severity of downstream impact (credential theft vs. full RCE/lateral movement) is further gated by the privilege level of the Ascent Capture Service account and whether SMB signing/egress filtering is enforced in the environment. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes a fully remote, unauthenticated, low-complexity attack with total impact to confidentiality, integrity, and availability, and CISA SSVC reinforces this with Exploitation=poc, Automatable=yes, and Technical Impact=total. Publicly available exploit code exists (VulnCheck PoC gist), and the flaw is automatable, so opportunistic scanning against exposed port 2424 is plausible. The one tempering signal is EPSS: 0.16% (37th percentile) and no CISA KEV listing, indicating no evidence of widespread active exploitation yet - consistent with a niche enterprise product that is typically not internet-exposed rather than a low-severity issue. The gap between a near-maximal CVSS/SSVC profile and low EPSS reflects limited attack surface (few internet-facing instances) rather than reduced technical severity; for any environment where port 2424 is reachable by an attacker, this should be treated as high priority. |
| Exploit ScenarioDerived | An attacker who can reach TCP/2424 on a Kofax Capture server sends crafted .NET Remoting messages to the unauthenticated Ascent Capture Service using its default endpoint identifier, instantiating a server-side WebClient to read sensitive files or coerce the service account into authenticating to an attacker SMB host. The captured NTLMv2 hash is then relayed or cracked for lateral movement, and depending on service privileges the file-write primitive can be chained to remote code execution. A public PoC (VulnCheck gist) demonstrates the file read/write and SMB-coercion primitives, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Unauthenticated remote file read/write and NTLM coercion in Kofax Capture (rebranded Tungsten Capture) 6.0.0.0 stems from the Ascent Capture Service exposing a deprecated .NET Remoting HTTP channel on TCP/2424 with a default, publicly known endpoint identifier and no authentication. A remote attacker can abuse .NET Remoting object unmarshalling to instantiate a server-side System.Net.WebClient, allowing arbitrary file read/write and coerced NTLMv2 authentication that can cascade into credential theft, denial of service, remote code execution, or lateral movement depending on the service account's privileges. Publicly available exploit code exists (VulnCheck/gist PoC); it is not listed in CISA KEV, and EPSS is low at 0.16% (37th percentile).
RemediationAI
No vendor-released patched version is independently confirmed in the available data, so treat remediation as compensating-control driven until Tungsten Automation publishes a fixed build (monitor the vendor advisory portal at https://docshield.tungstenautomation.com and the VulnCheck advisory). The most direct control is to block or firewall inbound access to TCP port 2424 on Ascent Capture Service hosts, restricting it to trusted management networks only - this severs the remote attack path with minimal functional impact if remote clients do not require that legacy channel. Where feasible, disable the deprecated .NET Remoting HTTP channel or restrict the Ascent Capture Service to internal segments, and run the service under a least-privileged account (not a domain admin or highly privileged service account) to limit the blast radius of coerced NTLMv2 authentication and potential RCE. To blunt NTLM relay/coercion, enforce SMB signing and channel binding/EPA and egress-filter outbound SMB (445) from capture servers, accepting that strict SMB signing can add overhead and break legacy integrations. Validate any interim controls do not disrupt legitimate capture-client connectivity before broad rollout.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
.NET Remoting is a legacy Microsoft RPC framework whose HTTP/binary channels deserialize (unmarshal) remote object references; when a well-known endpoint is reachable without authentication, an attacker can force the server to instantiate arbitrary marshal-by-reference types such as System.Net.WebClient, a classic .NET Remoting object-unmarshalling attack class Microsoft has deprecated precisely because it is unsafe to expose. Here the Ascent Capture Service (the core document-capture service of Kofax/Tungsten Capture) binds this channel on port 2424 with a default, publicly known endpoint name. The root cause maps to CWE-306 (Missing Authentication for Critical Function): a security-sensitive service interface is exposed with no authentication gate. The affected component is identified by CPE cpe:2.3:a:tungsten_automation:kofax_capture, confirming the Tungsten Automation (formerly Kofax) Capture product line.
Know when Kofax Capture gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity access to an unauthenticated .NET Remoting endpoint (AV:N/AC:L/PR:N/UI:N) yields file read/write and potential RCE/DoS, giving high C/I/A; scope unchanged as impact stays within the service host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling techniques to instantiate a remote System.Net.WebClient object and read arbitrary files from the server filesystem, write attacker-controlled files to the server, or coerce NTLMv2 authentication to an attacker-controlled host, enabling sensitive credential disclosure, denial of service, remote code execution, or lateral movement depending on service account privileges and network environment.
Executive ViewAI
Kofax Capture (Tungsten Capture) version 6.0.0.0 contains a critical unauthenticated vulnerability in a legacy .NET Remoting HTTP channel that enables attackers to read/write files, steal NTLM credentials, and execute remote code without any authentication required. Publicly available exploit code exists and no vendor patch has been released, creating immediate organizational risk for any system running this version.
No vendor-released patch identified at time of analysis. Restrict TCP/2424 access via firewall rules to only authorized administrative networks; run Kofax Capture Service with minimal required privileges (least-privilege principle); enforce NTLMv2 authentication and disable legacy NTLM protocols if feasible; enable detailed logging and real-time alerting for .NET Remoting channel access attempts; consider network segmentation to isolate affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB