CVE-2026-39906 Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting
Remote attackers can leak NTLMv2 hashes via .NET Remoting, enabling credential relay attacks for privilege escalation or lateral movement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39906?
CVE-2026-39906 is a high-severity vulnerability in Unisys WebPerfect Image Suite, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.
Weakness: CWE-441
Which versions are affected by CVE-2026-39906?
It affects 1 product.
Products include Unisys Webperfect Image Suite.
How do I fix CVE-2026-39906?
No fix has been published for CVE-2026-39906 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39906 being exploited?
There is no known exploitation of CVE-2026-39906 in the wild and no public exploit code.
Other vulnerabilities in Unisys WebPerfect Image Suite
Sources
Also known as GHSA-qhm2-fwj3-3r79.