High 7.0Published Apr 14, 2026

CVE-2026-39906Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting

Updated under an hour ago (Oct 27, 2026, 1:20 PM ET)

Does this affect you?

It affects Unisys WebPerfect Image Suite. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Unisys WebPerfect Image Suite

Exploited in the last 30 days

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.

CVSS: 7.0 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness (CWE): CWE-441
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Analyzed
Record last updated: May 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Unisys WebPerfect Image Suite unisys:webperfect_image_suite (from the name)	3.0.3960.22810; 3.0.3960.22604	CNA record
unisys webperfect_image_suite unisys:webperfect_image_suite	3.0.3960.22604; 3.0.3960.22810	NVD

References

References

https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129	technical-description, exploit, third-party-advisory
https://www.unisys.com/solutions/cai/applications/	product
https://www.vulncheck.com/advisories/unisys-webperfect-image-suite-ntlmv2-hash-leakage-via-net-remoting	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.