Cyber Posture

CVE-2026-39906

CriticalPublic PoC

Published: 14 April 2026

Published
14 April 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0020 41.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers…

more

can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-32 System Partitioning
addresses: CWE-441

Mitigates confused deputy risks by ensuring distinct privilege domains so one partition cannot unintentionally act on behalf of another.

Security SummaryAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-441

Affected Products

unisys
webperfect image suite
3.0.3960.22604, 3.0.3960.22810

References