Remote Code Execution in Unisys WebPerfect Image Suite Exposing NTLMv2 Hashes

CVE-2026-39906

What is CVE-2026-39906?

The Unisys WebPerfect Image Suite is affected by a vulnerability that allows remote unauthenticated attackers to exploit a deprecated .NET Remoting TCP channel. By supplying a crafted Windows UNC path as a target file argument, the vulnerable versions expose NTLMv2 machine-account hashes through object-unmarshalling techniques. This enables attackers to capture the leaked NTLMv2 hash, facilitating privilege escalation or lateral movement across a network, heavily depending on the specific configuration and patch status of the affected systems.

References