CVE-2026-26222: Altec DocLink RCE Vulnerability

CVE-2026-26222 Overview

CVE-2026-26222 is a critical insecure deserialization vulnerability affecting Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0. The vulnerability exists in the Altec.RDCHostService.exe service, which exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP using the ObjectURI doclinkServer.soap. Due to the lack of authentication and unsafe object unmarshalling, remote attackers can exploit this flaw to read and write arbitrary files, coerce SMB authentication, and ultimately achieve unauthenticated remote code execution.

Critical Impact

This vulnerability allows unauthenticated remote attackers to read arbitrary files, write malicious files to web-accessible directories, coerce SMB authentication via UNC paths, and achieve remote code execution or denial of service through file overwrite—all without any prior authentication.

Affected Products

• Altec DocLink version 4.0.336.0 (now maintained by Beyond Limits Inc.)
• Systems running Altec.RDCHostService.exe with exposed .NET Remoting endpoints
• IIS deployments with writable web-accessible paths

Discovery Timeline

• 2026-02-24 - CVE-2026-26222 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-26222

Vulnerability Analysis

This vulnerability stems from the insecure implementation of .NET Remoting in the Altec DocLink service. The Altec.RDCHostService.exe process exposes remoting endpoints via both TCP and HTTP/SOAP protocols without requiring any form of authentication. The service utilizes the ObjectURI doclinkServer.soap to handle remote method invocations.

The core issue lies in the unsafe deserialization of objects received through these remoting channels. When .NET Remoting processes incoming requests, it deserializes object data without proper validation, creating a classic CWE-502 (Deserialization of Untrusted Data) condition. This allows attackers to craft malicious serialized objects that, when processed by the server, execute arbitrary operations.

The vulnerability enables multiple attack vectors: arbitrary file read operations by specifying local file paths, SMB authentication coercion through UNC path manipulation, and arbitrary file write capabilities. When the writable paths align with IIS web-accessible directories, attackers can upload web shells or malicious scripts, escalating the attack to full remote code execution.

Root Cause

The root cause is CWE-502: Deserialization of Untrusted Data. The Altec.RDCHostService.exe service implements .NET Remoting without authentication controls and processes serialized objects from untrusted sources without proper validation. The use of the legacy .NET Remoting framework, which is known to be inherently insecure, combined with the exposure of the doclinkServer.soap endpoint to network access creates an exploitable attack surface. Microsoft has deprecated .NET Remoting specifically due to these security concerns, recommending migration to more secure alternatives like WCF or gRPC.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the vulnerable DocLink service can send specially crafted requests to the doclinkServer.soap endpoint. The attack chain typically proceeds as follows:

1. The attacker identifies the exposed .NET Remoting endpoint on the target system
2. Malicious serialized payloads are crafted to exploit the unsafe unmarshalling
3. For file read operations, the attacker specifies local file paths to exfiltrate sensitive data
4. For SMB coercion, UNC paths are used to capture authentication hashes for offline cracking
5. For remote code execution, the attacker writes malicious files (such as ASPX web shells) to IIS web-accessible directories
6. The attacker accesses the uploaded web shell to execute arbitrary commands on the server

The vulnerability mechanism exploits .NET Remoting's unsafe deserialization behavior. When the service receives requests on the doclinkServer.soap endpoint, it processes serialized objects without authentication or input validation. Attackers can leverage this to read files using local paths, write files to server locations including web directories, and coerce NTLM authentication through UNC path references. For detailed technical analysis, refer to the VulnCheck Advisory.

Detection Methods for CVE-2026-26222

Indicators of Compromise

• Unexpected connections to the .NET Remoting ports (typically TCP/808 or configured HTTP ports) from external sources
• Unusual file access patterns in system directories or IIS web roots originating from Altec.RDCHostService.exe
• New or modified .aspx, .asmx, or script files appearing in IIS wwwroot directories
• SMB authentication attempts to external or unknown UNC paths from the DocLink server

Detection Strategies

• Deploy network monitoring rules to detect traffic patterns characteristic of .NET Remoting exploitation targeting the doclinkServer.soap endpoint
• Implement file integrity monitoring (FIM) on IIS web directories to detect unauthorized file writes
• Monitor process execution chains where Altec.RDCHostService.exe spawns unexpected child processes
• Configure SIEM correlation rules for anomalous file read operations or SMB authentication coercion attempts

Monitoring Recommendations

• Enable detailed logging for the Altec.RDCHostService.exe service and correlate with network traffic analysis
• Monitor Windows Security event logs for unusual file access (Event ID 4663) and object access events
• Deploy EDR solutions to detect post-exploitation behaviors such as web shell execution or lateral movement
• Establish baseline network behavior for DocLink services and alert on deviations

How to Mitigate CVE-2026-26222

Immediate Actions Required

• Restrict network access to the .NET Remoting endpoints using firewall rules, limiting exposure to trusted networks only
• If the DocLink service is not required, disable or uninstall Altec.RDCHostService.exe
• Audit IIS web directories for any suspicious files that may have been written by attackers
• Implement network segmentation to isolate DocLink servers from critical infrastructure

Patch Information

Organizations should contact Beyond Limits Inc. for information regarding patched versions of Altec DocLink. Review the VulnCheck Advisory for the latest remediation guidance. Until a patch is available, implement the workarounds below to reduce exposure.

Workarounds

• Block external network access to TCP and HTTP ports used by the DocLink .NET Remoting service using host-based and network firewalls
• Implement application whitelisting to prevent unauthorized executables from running in IIS directories
• Configure IIS to use a dedicated, non-writable directory separate from the application paths accessible by DocLink
• Deploy web application firewall (WAF) rules to block suspicious SOAP requests targeting the doclinkServer.soap endpoint

# Example Windows Firewall rule to block external access to .NET Remoting
netsh advfirewall firewall add rule name="Block DocLink Remoting External" ^
    dir=in action=block protocol=tcp localport=808 ^
    remoteip=any profile=any

# Restrict access to trusted internal network only
netsh advfirewall firewall add rule name="Allow DocLink Remoting Internal" ^
    dir=in action=allow protocol=tcp localport=808 ^
    remoteip=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 profile=any