CVE-2026-23751

The Ascent Capture Service exposes a .NET Remoting HTTP channel on port 2424 using a default, publicly known endpoint identifier and without any authentication mechanism. An attacker can exploit .NET Remoting object deserialization techniques to remotely instantiate objects such as System.Net.WebClient. This allows reading arbitrary files from the server file system, writing attacker-controlled files, or forcing NTLMv2 authentication coercion against a host controlled by the attacker.

An attacker can gain unauthorized access to server files, execute remote code (RCE), cause denial of service (DoS), intercept NTLMv2 credentials, or perform lateral movement – the scope of impact depends on service account permissions and network configuration.

Apply patches available from the vendor according to references (Tungsten Automation documentation: https://docshield.tungstenautomation.com). Additionally, it is recommended to restrict network access to port 2424 exclusively to trusted hosts (firewall/network segmentation) and disable the .NET Remoting HTTP channel if not required for system operation.

Kofax Capture / Tungsten Capture version 6.0.0.0; other versions may also be vulnerable according to vendor description.