SSRF in Beyond Altec Doclink
CVE-2026-26222
Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.015 · change: +0.008
Affected products
- Beyond Altec Doclink — versions 4.0.336.0
- Beyond Limits Inc. Altec Doclink — versions 4.0.336.0
Weakness classification (CWE)
References
- doclinkai.com/ (Product, product)
- www.vulncheck.com/advisories/doclink-net-remoting-unauthenticated-arbitrary-fil… (VDB Entry, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-26222?
- CVE-2026-26222 is a critical-severity vulnerability in Beyond Altec Doclink, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-02-24.
- How severe is CVE-2026-26222?
- Critical severity. CVSS v3 base score is 9.8 out of 10.