CVE-2026-26221 Overview
CVE-2026-26221 is a critical insecure deserialization vulnerability affecting Hyland OnBase's Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). The vulnerability stems from an unauthenticated .NET Remoting exposure that allows remote attackers to send crafted requests to default HTTP channel endpoints on TCP/8900, triggering unsafe object unmarshalling. This can enable arbitrary file read/write operations and, when chained with other OnBase features, lead to full remote code execution. Additionally, the vulnerability can be exploited for NTLM authentication coercion attacks.
Critical Impact
Unauthenticated attackers with network access can achieve remote code execution by exploiting unsafe .NET deserialization, potentially compromising the entire OnBase environment and any connected systems.
Affected Products
- Hyland OnBase (Workflow Timer Service component)
- Hyland OnBase installations with Hyland.Core.Workflow.NTService.exe exposed on TCP/8900
- OnBase environments with accessible .rem endpoints (TimerServiceAPI.rem, TimerServiceEvents.rem)
Discovery Timeline
- 2026-02-13 - CVE-2026-26221 published to NVD
- 2026-02-13 - Last updated in NVD database
Technical Details for CVE-2026-26221
Vulnerability Analysis
This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and represents a severe security flaw in the OnBase Workflow Timer Service. The service exposes .NET Remoting endpoints without proper authentication, allowing any attacker with network access to the service port to interact with sensitive deserialization functionality.
The root issue lies in the unsafe handling of serialized .NET objects received through the HTTP channel. When the service processes incoming requests to endpoints such as TimerServiceAPI.rem and TimerServiceEvents.rem, it deserializes object data without validating the source or sanitizing the content. This behavior is particularly dangerous because .NET Remoting was designed for trusted environments and lacks built-in security controls for untrusted input.
The impact extends beyond simple code execution. Attackers can leverage this primitive for arbitrary file read/write operations, which can be escalated to full remote code execution by writing malicious content to web-accessible directories. The vulnerability also enables NTLM relay attacks by coercing outbound authentication to attacker-controlled SMB shares via UNC paths.
Root Cause
The root cause is the exposure of .NET Remoting channels without authentication on the Workflow Timer Service. The service binds to TCP port 8900 and accepts serialized object data through HTTP channels (TimerServiceAPI.rem, TimerServiceEvents.rem) without verifying caller identity or validating the deserialized object types. This architectural flaw allows untrusted input to reach the deserialization logic, where malicious payloads can instantiate arbitrary objects and execute attacker-controlled code.
Attack Vector
The attack vector is network-based, requiring no authentication or user interaction. An attacker who can reach TCP/8900 on a vulnerable OnBase server can craft malicious .NET Remoting requests targeting the exposed .rem endpoints. The attack flow typically involves:
- Network reconnaissance to identify OnBase Workflow Timer Service instances on TCP/8900
- Crafting serialized .NET objects containing malicious gadget chains
- Sending requests to TimerServiceAPI.rem or TimerServiceEvents.rem endpoints
- Exploiting unsafe deserialization to write files to web-accessible directories or coerce NTLM authentication
The vulnerability does not require any prior authentication, making it particularly dangerous for organizations with OnBase services exposed to untrusted networks. Exploitation can lead to arbitrary file operations, and when combined with web-accessible OnBase paths, full remote code execution. Alternatively, attackers can supply UNC paths to capture NTLM hashes for offline cracking or relay attacks.
Detection Methods for CVE-2026-26221
Indicators of Compromise
- Unexpected network connections to TCP/8900 from non-administrative hosts
- HTTP requests to .rem endpoints (TimerServiceAPI.rem, TimerServiceEvents.rem) from untrusted sources
- Unusual outbound SMB/NTLM traffic from OnBase servers to external or unknown IP addresses
- New or modified files in OnBase web directories that were not part of normal operations
- Windows event logs showing Hyland.Core.Workflow.NTService.exe processing errors or exceptions related to deserialization
Detection Strategies
- Deploy network intrusion detection rules to monitor for suspicious traffic patterns to TCP/8900
- Implement endpoint detection rules to identify .NET deserialization gadget chain execution patterns
- Monitor for anomalous file write operations by the Hyland.Core.Workflow.NTService.exe process
- Configure SIEM correlation rules to detect NTLM authentication attempts to external hosts originating from OnBase servers
Monitoring Recommendations
- Enable verbose logging on the OnBase Workflow Timer Service and forward logs to centralized SIEM
- Monitor Windows Security Event Logs for process creation events (Event ID 4688) spawned by the Timer Service
- Implement network segmentation monitoring to alert on any lateral movement from OnBase infrastructure
- Track SMB traffic (TCP/445) from OnBase servers to detect potential NTLM coercion attempts
How to Mitigate CVE-2026-26221
Immediate Actions Required
- Restrict network access to TCP/8900 using firewall rules, limiting connectivity to only trusted administrative hosts
- Apply the security patch referenced in Hyland Security Bulletin OB2025-03
- Audit existing OnBase deployments to identify exposed Workflow Timer Service instances
- Implement network segmentation to isolate OnBase infrastructure from untrusted network zones
- Review logs for evidence of prior exploitation attempts
Patch Information
Hyland has released a security update addressing this vulnerability. Organizations should consult the Hyland Security Bulletin OB2025-03 for patch download and installation instructions. The VulnCheck Advisory provides additional technical context and affected version information.
Workarounds
- Block inbound TCP/8900 traffic at the network perimeter and host-based firewalls until patches can be applied
- Disable the Workflow Timer Service temporarily if it is not business-critical
- Implement network-level authentication requirements for accessing OnBase service ports where possible
- Block outbound SMB traffic (TCP/445) from OnBase servers to mitigate NTLM coercion attacks
# Windows Firewall rule to restrict TCP/8900 access to specific trusted hosts
netsh advfirewall firewall add rule name="Block OnBase Timer Service" dir=in action=block protocol=tcp localport=8900
netsh advfirewall firewall add rule name="Allow OnBase Timer Service Trusted" dir=in action=allow protocol=tcp localport=8900 remoteip=10.0.0.5,10.0.0.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
