What is CVE-2026-26221?

CVE-2026-26221 is a critical-severity vulnerability in Hyland Onbase Workflow Timer Service, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-02-13.

How severe is CVE-2026-26221?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Deserialization in Hyland Onbase Workflow Timer Service

CVE-2026-26221

Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP chann…

Vulnerability class: Insecure Deserialization

EPSS: 0.011 (62.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hyland Onbase Workflow Timer Service — versions 8.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (vendor-advisory, permissions-required, mitigation)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-26221?: CVE-2026-26221 is a critical-severity vulnerability in Hyland Onbase Workflow Timer Service, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-02-13.
How severe is CVE-2026-26221?: Critical severity. CVSS v3 base score is 9.8 out of 10.