Deserialization in Hyland Onbase Workflow Timer Service
CVE-2026-26221
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.014 (71.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 71.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.014 · change: +0.003
Affected products
- Hyland Onbase Workflow Timer Service — versions 8.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.hyland.com/en/solutions/products/onbase (product)
- community.hyland.com/resources/bulletins-and-notices/223223-security-update-onb… (vendor-advisory, permissions-required, mitigation)
- www.vulncheck.com/advisories/hyland-onbase-timer-services-unauthenticated-net-r… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-26221?
- CVE-2026-26221 is a critical-severity vulnerability in Hyland Onbase Workflow Timer Service, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-02-13.
- How severe is CVE-2026-26221?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2026-26221 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.