CVE-2026-58126 Overview
CVE-2026-58126 is an unauthenticated remote code execution vulnerability in PACSgear PACS Scan 5.2.1. The flaw resides in an exposed .NET Remoting TCP service listening on port 22222, hosted by PGImageExchQueue.exe. Because the service exposes arbitrary file read and write primitives without any authentication requirement [CWE-306], remote attackers can drop files anywhere on the host filesystem. Attackers chain the file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads CRYPTSP.DLL from the application directory when missing, to execute code as NT AUTHORITY\SYSTEM on service restart.
Critical Impact
Unauthenticated network attackers can achieve SYSTEM-level code execution on healthcare imaging infrastructure running PACSgear PACS Scan 5.2.1.
Affected Products
- PACSgear PACS Scan 5.2.1
- PGImageExchQueue.exe .NET Remoting service on TCP port 22222
- PGImageExchangeQueueSvc.exe service loading CRYPTSP.DLL
Discovery Timeline
- 2026-07-01 - CVE-2026-58126 published to the National Vulnerability Database (NVD)
- 2026-07-01 - CVE-2026-58126 last updated in NVD database
Technical Details for CVE-2026-58126
Vulnerability Analysis
PACSgear PACS Scan 5.2.1 exposes a legacy .NET Remoting endpoint over TCP port 22222 through the PGImageExchQueue.exe process. The service accepts serialized method invocations from remote clients without validating the caller's identity. Two of the exposed methods provide arbitrary file read and arbitrary file write primitives against the host filesystem. This design choice violates the principle of authenticated access to privileged operations and maps directly to [CWE-306] Missing Authentication for Critical Function.
The write primitive alone would allow tampering with configuration files or dropping payloads. Combined with DLL search order behavior in a sibling service, it becomes a reliable code execution path.
Root Cause
The root cause is the absence of authentication on the .NET Remoting channel. .NET Remoting itself does not enforce authentication by default when configured with a plain TcpChannel, and the PACS Scan implementation did not layer authorization on top of the exposed remote objects. Any network peer that can reach TCP 22222 can invoke methods that operate on the local filesystem with service privileges.
Attack Vector
An attacker on the network connects to port 22222 and invokes the remote file write method to place a malicious CRYPTSP.DLL in the installation directory of PGImageExchangeQueueSvc.exe. The victim service loads CRYPTSP.DLL from its own directory because the file is not present under System32 in the resolution order used, satisfying a classic DLL hijacking condition. When the service is restarted, either manually, through an update, or by triggering a crash, Windows loads the attacker-supplied DLL into the service process. The service runs as NT AUTHORITY\SYSTEM, giving the attacker full control of the host.
A proof-of-concept demonstrating the .NET Remoting client interaction is published on the GitHub Gist PoC and further documented in the VulnCheck RCE Advisory.
Detection Methods for CVE-2026-58126
Indicators of Compromise
- Inbound TCP connections to port 22222 on hosts running PACSgear PACS Scan from addresses outside expected imaging workstations.
- Presence of a CRYPTSP.DLL file inside the PACS Scan installation directory, particularly next to PGImageExchangeQueueSvc.exe.
- Unexpected child processes spawned by PGImageExchangeQueueSvc.exe running as SYSTEM.
- Recent file writes into the PACS Scan application directory by the PGImageExchQueue.exe process.
Detection Strategies
- Monitor Windows service creation, restart, and crash events for PGImageExchangeQueueSvc correlated with recent filesystem writes in its install path.
- Alert on module load events where CRYPTSP.DLL is loaded from a non-System32 path by a service process.
- Inspect network flows for external hosts reaching TCP 22222 and flag any session that precedes a service restart on the same asset.
Monitoring Recommendations
- Baseline the expected clients of the PACS Scan Remoting service and alert on deviations.
- Enable Sysmon Event IDs 7 (Image Loaded) and 11 (FileCreate) on PACS Scan hosts and forward to a central SIEM.
- Review scheduled tasks, service definitions, and startup entries on PACS Scan hosts for persistence artifacts.
How to Mitigate CVE-2026-58126
Immediate Actions Required
- Block inbound access to TCP port 22222 at the host firewall and network segmentation boundary, permitting only trusted PACS Scan clients.
- Inventory all PACSgear PACS Scan 5.2.1 deployments and isolate them from general-purpose networks and internet exposure.
- Verify the integrity of the PACS Scan installation directory and remove any unauthorized CRYPTSP.DLL or other unexpected DLLs.
- Restrict service account permissions where feasible and monitor service restarts closely.
Patch Information
No vendor patch is referenced in the published advisory data. Consult the Hyland Product Overview for vendor support channels and the VulnCheck RCE Advisory for the latest remediation status.
Workarounds
- Apply host-based firewall rules to restrict TCP 22222 to explicit source IP allowlists.
- Place PACS Scan systems behind a dedicated VLAN with strict access control lists for clinical imaging traffic only.
- Where operationally acceptable, stop and disable the .NET Remoting service until a vendor fix is available.
- Apply strict NTFS ACLs on the PACS Scan installation directory so that only administrators can create or modify DLL files.
# Example Windows firewall rule to block inbound access to the .NET Remoting service port
netsh advfirewall firewall add rule name="Block PACSgear Remoting 22222" dir=in action=block protocol=TCP localport=22222
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
