CVE-2026-26339

The vulnerability (CWE-918 / argument injection) occurs in the module responsible for document processing. An attacker can submit a crafted request to the service without needing to possess any credentials by injecting malicious arguments into process calls or system commands executed during document transformation. As a result, arbitrary code execution in the context of the service process is possible.

An unauthenticated attacker can take full control of the system on which the service is running — gaining the ability to read and modify data as well as disrupt system operations. The compromise affects only the directly vulnerable component (SC:N in the CVSS vector).

Patches available from the vendor should be applied in accordance with the references — detailed information about versions containing fixes was published in the official Hyland security bulletin at the address indicated in the references (connect.hyland.com).

Hyland Alfresco Transform Service and Hyland Alfresco Transform Core — versions indicated in the vendor's references