CVE-2026-39906CWE-441

Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting

High · published April 14, 2026

CVSS v4.0
7.0
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00875 · 58.5th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2026-04-14T21:21Z
EPSS history
Timeline
  • 14 APR 21:21Z
    Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting
    cvelistv5