CVE-2026-26339: Hyland Alfresco Transformation Service Argument Injection with Remote Code Execution

Overview

Hyland Alfresco Transformation Service is affected by CVE-2026-26339, an argument injection vulnerability in its document processing functionality. According to the record, unauthenticated attackers may achieve remote code execution. VulnCheck is the CNA, and the vendor security update references this CVE alongside CVE-2026-26337 and CVE-2026-26338.

Impact

Confirmed by the record: the flaw allows unauthenticated remote code execution.
The record lists a CVSS base score of 9.8 (critical), with a vector describing network reachability, low complexity, no privileges or user interaction required, and high confidentiality, integrity and availability impact.
A further score of 9.3 is recorded under a newer CVSS version.
The SSVC data marks technical impact as total and the issue as automatable.

Affected products and versions

Hyland Alfresco Community (Transform Core) and Hyland Alfresco Transform Core: versions before 5.2.4.
Hyland Alfresco Transform Service and Hyland Alfresco Transformation Service (Enterprise): versions before 4.2.3.
The record's fixes field is empty. The fixed boundaries above are inferred from the affected ranges, so confirm exact fixed builds in the vendor advisory.

Exploitation status

The CVE is not listed in CISA KEV, so no active exploitation is claimed here.
No confirmed exploitation appears in the sources consulted.
SSVC exploitation is recorded as none. The EPSS probability is 0.01179, with a percentile of 0.67454.

Remediation and mitigation

Plan an upgrade to the fixed releases for your product line, at or beyond 5.2.4 for Transform Core or 4.2.3 for Transform Service, following the vendor advisory.
Limit network access to transformation services so they are not reachable from untrusted networks.
Until patched, reduce exposure by restricting which systems can submit documents for processing.

Detection guidance

Review logs of document transformation requests for unusual or malformed parameters from unexpected sources.
Watch for unexpected child processes or outbound connections originating from the transformation service.
Correlate alerts with asset inventories to confirm which instances run affected versions.

Limitations of the available information

The record's CWE is CWE-918 (Server-Side Request Forgery), which differs from the argument injection description, so the technical classification is unresolved.
No technical details of the injection vector are included, and this analysis does not describe them.
This analysis relies on the record and does not verify the content of the vendor advisory.

Frequently asked questions

Does this CVE require authentication to exploit?

The record describes the flaw as allowing unauthenticated attackers to achieve remote code execution, and the CVSS vector lists no privileges required. Verify this against the vendor advisory.

Which versions are affected?

According to the record, Alfresco Community (Transform Core) and Alfresco Transform Core are affected before 5.2.4, and Alfresco Transform Service and Alfresco Transformation Service (Enterprise) are affected before 4.2.3.

Is this vulnerability known to be exploited in the wild?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. SSVC exploitation is recorded as none.

What should administrators do now?

Plan an upgrade to the fixed releases following the vendor advisory, restrict network access to transformation services, and review logs for unusual requests while patching is pending.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.