CVE-2026-26339CWE-918

Hyland Alfresco Transformation Service Argument Injection RCE

Critical · published February 19, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01179 · 67.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-02-19T17:04Z
EPSS history
Timeline
  • 19 FEB 17:04Z
    Hyland Alfresco Transformation Service Argument Injection RCE
    cvelistv5