Vulnerability · Published Feb 13, 2026 · Assigned by VulnCheck
CVE-2026-26221Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE
Critical 9.8
In plain English
A critical-severity unsafe deserialization in OnBase Workflow Timer Service from Hyland. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hyland | OnBase Workflow Timer Service | 8.0 – through 17.0.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.hyland.com/en/solutions/products/onbase product
- https://community.hyland.com/resources/bulletins-and-notices/223223-security-update-onbase-workflow-timer-service-bulletin-ob2025-03 vendor-advisory, mitigation, permissions-required
- https://www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-remoting-rce third-party-advisory