Unauthenticated Remote Code Execution in PACSgear MediaWriter
CVE-2026-58127

9.3CRITICAL

Key Information:

Vendor

Hyland

Status
Pacsgear Mediawriter
Vendor
CVE Published:
1 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-58127?

PACSgear MediaWriter 5.2.1 exposes a critical vulnerability via its .NET Remoting TCP service on port 9000. The service does not require authentication and allows remote attackers to read and write arbitrary files on the host system. By exploiting the unmarshalling technique of the MarshalByRefObject object, an attacker may leverage the .NET WebClient class methods to manipulate the filesystem. The default ObjectURIs across installations further amplify the risk. Combined with potential DLL hijacking, this vulnerability can lead to unauthorized code execution with system-level privileges upon service restart.

Affected Version(s)

PACSgear MediaWriter 5.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-58127 - Proof of Concept

References

https://gist.github.com/VAMorales/dc679ecab30b7045fa07bf3...
technical-descriptionexploit
https://www.hyland.com/en/solutions/products/pacsgear
product
https://www.vulncheck.com/advisories/pacsgear-mediawriter...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp
Jan A. Rodriguez, Pentester, GM Sectec, Corp.
.