CVE-2026-26339 | Hyland Alfresco Transformation Service allows unauthenticate… | CVSS 9.8 CRITICAL

Description

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

Metadata

CVE ID: CVE-2026-26339
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-13 17:28 UTC
Published: 2026-02-19 17:04 UTC
Last updated: 2026-07-28 01:48 UTC
Primary CWE: CWE-918
CWE-918 Server-Side Request Forgery (SSRF)
Vendor / Product: Hyland / Alfresco Transformation Service (Enterprise)
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (2)

Vendor	Product	Platform	Versions
Hyland	Alfresco Community (Transform Core)	—	0 < 5.2.4
Hyland	Alfresco Transformation Service (Enterprise)	—	0 < 4.2.3

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	CWE-918 Server-Side Request Forgery (SSRF)

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)