CVE-2026-39906 Overview
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 contain a critical vulnerability in their deprecated .NET Remoting TCP channel implementation. This security flaw allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Once captured, these NTLMv2 hashes can be relayed to other hosts, enabling privilege escalation or lateral movement depending on the target network's configuration and patch level.
Critical Impact
Remote unauthenticated attackers can capture NTLMv2 machine-account hashes and relay them to achieve privilege escalation or lateral movement across the network.
Affected Products
- Unisys WebPerfect Image Suite version 3.0.3960.22810
- Unisys WebPerfect Image Suite version 3.0.3960.22604
Discovery Timeline
- 2026-04-14 - CVE-2026-39906 published to NVD
- 2026-04-14 - Last updated in NVD database
Technical Details for CVE-2026-39906
Vulnerability Analysis
This vulnerability stems from the exposure of a deprecated .NET Remoting TCP channel in Unisys WebPerfect Image Suite. The .NET Remoting framework, which Microsoft has long considered obsolete in favor of Windows Communication Foundation (WCF), lacks modern security controls and is inherently susceptible to various attack vectors when exposed to untrusted networks.
The attack exploits the object unmarshalling process within the .NET Remoting channel. When an attacker supplies a malicious Windows UNC path (such as \\attacker-server\share\file) as a target file argument, the vulnerable application attempts to access this remote resource using the machine account's credentials. This triggers an NTLM authentication attempt to the attacker-controlled server, leaking the NTLMv2 hash.
The vulnerability is classified under CWE-441 (Unintended Proxy or Intermediary), as the application inadvertently acts as a proxy that forwards authentication credentials to attacker-controlled destinations. The network-based attack vector with no authentication requirements makes this vulnerability particularly dangerous in enterprise environments.
Root Cause
The root cause of this vulnerability is twofold:
Deprecated Protocol Exposure: The application exposes a .NET Remoting TCP channel, which lacks modern security mechanisms and should not be accessible to untrusted networks.
Insufficient Input Validation: The application fails to properly validate and sanitize file path arguments before processing them. When a UNC path is provided, the application blindly attempts to access the remote resource, triggering an outbound NTLM authentication request.
Attack Vector
The attack follows a well-established pattern for NTLM relay attacks:
Reconnaissance: The attacker identifies an exposed .NET Remoting TCP channel on the target Unisys WebPerfect Image Suite installation.
Hash Capture Setup: The attacker configures an NTLM hash capture tool (such as Responder or ntlmrelayx) on an attacker-controlled server.
Exploitation: Through the .NET Remoting channel, the attacker sends a malicious request containing a UNC path pointing to their capture server as the target file argument.
Credential Theft: The vulnerable application attempts to access the UNC path, initiating an NTLM authentication handshake with the attacker's server, which captures the NTLMv2 hash.
Post-Exploitation: The captured hash can be used for offline password cracking or, more commonly, relayed to other services on the network that accept NTLM authentication.
The attack is particularly effective because it requires no authentication to the vulnerable service and can be executed entirely over the network. For detailed technical information, refer to the VulnCheck Advisory.
Detection Methods for CVE-2026-39906
Indicators of Compromise
- Unexpected outbound SMB (TCP 445) or NetBIOS (TCP 139) connections from servers hosting WebPerfect Image Suite to external or unusual internal IP addresses
- .NET Remoting TCP channel activity on non-standard ports from untrusted network segments
- Windows Security Event ID 4648 (explicit credential logon) showing machine account authentication to unexpected destinations
- Network traffic containing UNC paths in .NET Remoting serialized objects
Detection Strategies
- Deploy network intrusion detection rules to monitor for .NET Remoting traffic patterns and outbound NTLM authentication attempts
- Configure Windows Advanced Audit Policy to log all authentication events (Event IDs 4624, 4625, 4648) for machine accounts associated with WebPerfect Image Suite servers
- Implement egress filtering alerts for SMB traffic originating from application servers to non-whitelisted destinations
- Use endpoint detection and response (EDR) solutions to monitor for suspicious process behavior involving outbound credential usage
Monitoring Recommendations
- Enable enhanced logging for .NET applications to capture remoting channel activity and file access patterns
- Monitor for anomalous authentication patterns where machine accounts attempt to authenticate to external resources
- Implement network flow analysis to baseline normal SMB traffic patterns and alert on deviations
- Configure SentinelOne Singularity to detect and alert on NTLM relay attack patterns and suspicious credential usage
How to Mitigate CVE-2026-39906
Immediate Actions Required
- Identify all instances of Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 in your environment
- Restrict network access to the .NET Remoting TCP channel using host-based or network firewalls to allow only trusted sources
- Implement SMB signing and consider enabling Extended Protection for Authentication (EPA) to mitigate NTLM relay attacks
- Block outbound SMB traffic (TCP 445, 139) from WebPerfect Image Suite servers to external networks
Patch Information
Consult Unisys Application Solutions for official patch availability and upgrade guidance. Review the VulnCheck Advisory for the latest remediation information.
Workarounds
- Disable or restrict the deprecated .NET Remoting TCP channel if not required for business operations
- Implement network segmentation to isolate WebPerfect Image Suite servers from untrusted network segments
- Configure Windows Defender Credential Guard to protect NTLM credentials from being extracted or relayed
- Deploy egress firewall rules blocking outbound SMB traffic from application servers to prevent hash relay attacks
# Block outbound SMB traffic from WebPerfect Image Suite servers
# Windows Firewall example
netsh advfirewall firewall add rule name="Block Outbound SMB" dir=out action=block protocol=tcp remoteport=445
netsh advfirewall firewall add rule name="Block Outbound NetBIOS" dir=out action=block protocol=tcp remoteport=139
# Enable SMB signing via Group Policy (requires domain admin)
# Set: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
# Microsoft network client: Digitally sign communications (always) = Enabled
# Microsoft network server: Digitally sign communications (always) = Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
