Critical severity · published Feb 19, 2026
CVE-2026-26339
Hyland Alfresco Transformation Service Argument Injection RCE
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Alfresco Community (Transform Core) · Hyland
before 5.2.4 · source: vendor
AT
Alfresco Transformation Service (Enterprise) · Hyland
before 4.2.3 · source: vendor
AT
Alfresco Transform Core · Hyland
before 5.2.4 · source: NVD
AT
Alfresco Transform Service · Hyland
before 4.2.3 · source: NVD
Affected product
AC
Alfresco Community (Transform Core)
Hyland
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26339
Vendor Advisory
https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551
Product
https://www.hyland.com/en/solutions/products/alfresco-platform
Third Party Advisory
https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-argument-injection-rce
More from Alfresco Community (Transform Core)
9.8
CVE-2026-26338
Hyland Alfresco Transformation Service SSRF
8.2
CVE-2026-26337
Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF