CVE-2026-23751: Kofax (Tungsten) Capture Ascent Service Unauthenticated .NET Remoting Endpoint
CVE-2026-23751 affects Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 and possibly other versions. According to the record, a deprecated .NET Remoting HTTP channel on port 2424 is reachable without authentication and uses a publicly known endpoint identifier. The record is rated Critical (CVSS v3.1 9.8), is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Overview
Kofax Capture, now referred to as Tungsten Capture, exposes a deprecated .NET Remoting HTTP channel on port 2424 through the Ascent Capture Service, as described in the CVE record and the VulnCheck advisory. The weakness is classified as CWE-306, Missing Authentication for Critical Function. The record states that the channel uses a default, publicly known endpoint identifier.
Impact
The record describes several possible outcomes: disclosure of sensitive credentials, denial of service, remote code execution, and lateral movement. The actual outcome depends on the privileges of the service account and the network environment.
- CVSS v3.1: 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- CVSS v4.0: 9.3, also provided by VulnCheck as the CNA.
- The scores come from the record; no independent verification is shown in the sources consulted.
Affected products and versions
- Kofax Capture (now Tungsten Capture), version 6.0.0.0, is named in the record.
- The record states that other versions may be affected, but the structured affected list is empty, so the full range is unknown.
- Vendor documentation is available from Tungsten Automation DocShield, though it should be checked for the specific version in use.
Exploitation status
- The record shows the vulnerability is not listed in CISA KEV.
- No confirmed exploitation appears in the sources consulted.
- The EPSS probability is 0.00883 with a percentile of 0.58126, as recorded in the source data.
Remediation and mitigation
- The record lists no fixed version. This does not mean no fix exists; check the vendor advisories and product documentation for current guidance.
- Restrict network access to the service port so that only required, trusted hosts can reach it. Do not expose it to untrusted networks or the internet.
- If the deprecated remoting channel is not needed, follow vendor guidance to disable or remove it.
- Run the service under a least-privilege account and limit outbound SMB and NTLM traffic from application servers.
- If exposure is suspected, review and rotate credentials that the service or its accounts may have used.
Detection guidance
- Review connections to TCP port 2424 and identify any from unexpected or untrusted sources.
- Monitor servers running the service for unexpected outbound SMB or authentication attempts to external hosts.
- Watch for unexpected file creation or modification in the service directories and application folders.
- Review Ascent Capture Service logs for anomalies in remoting activity.
Limitations of the available information
- The affected version range, fixed versions and vendor patch status are not provided in the record.
- Other versions are said to be possibly affected, but none are confirmed.
- Exploitability conditions in real deployments are not confirmed by the sources consulted.
- The record does not provide exploitation details, and this analysis does not reproduce them.
Frequently asked questions
Is CVE-2026-23751 known to be actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitor vendor and CISA updates for changes.
Is there a fixed version available?
The record lists no fixed version. Check the vendor documentation for current patch information, since a missing entry does not mean no fix exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.