CVE-2026-58127: PACSgear MediaWriter RCE Vulnerability

CVE-2026-58127 Overview

CVE-2026-58127 affects PACSgear MediaWriter 5.2.1, a medical imaging product from Hyland. The application exposes a .NET Remoting Transmission Control Protocol (TCP) service on port 9000 through PacsgearMediaServerEngine.dll. The service registers two ObjectURIs, RemoteObj and UIRemoteObj, without any authentication requirement [CWE-306]. An unauthenticated remote attacker can abuse MarshalByRefObject unmarshalling to invoke .NET WebClient methods and read or write arbitrary files. Chaining the arbitrary write with Dynamic Link Library (DLL) hijacking of missing dependencies such as CRYPTBASE.DLL yields code execution as NT Authority\SYSTEM when the service restarts.

Critical Impact
Unauthenticated network attackers can achieve remote code execution as SYSTEM on hosts running PACSgear MediaWriter 5.2.1, exposing patient imaging data and downstream clinical systems.

Affected Products

PACSgear MediaWriter 5.2.1
Deployments exposing TCP port 9000 with default RemoteObj and UIRemoteObj ObjectURIs
Hyland PACSgear product line integrations dependent on the vulnerable MediaWriter service

Discovery Timeline

2026-07-01 - CVE-2026-58127 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58127

Vulnerability Analysis

PACSgear MediaWriter 5.2.1 hosts a .NET Remoting endpoint that binds to TCP port 9000 and accepts serialized method invocations without authentication. The registered ObjectURIs RemoteObj and UIRemoteObj are static across every installation, so attackers do not need reconnaissance to locate them. An attacker connects to the port and unmarshals a MarshalByRefObject reference of their choosing. Using the System.Net.WebClient class exposed through the remote object, the attacker calls DownloadFile or UploadFile to read from and write to the filesystem with the privileges of the MediaWriter service, which runs as NT Authority\SYSTEM.

The arbitrary write primitive becomes remote code execution through DLL hijacking. The MediaWriter service attempts to load CRYPTBASE.DLL and other dependencies from its application directory before falling back to system paths. Dropping a malicious DLL with a matching name into the writable application directory causes the SYSTEM-level service to load attacker-controlled code the next time it restarts. See the VulnCheck Advisory on PACSGear and the GitHub Gist PoC Script for technical details.

Root Cause

The root cause is missing authentication on a legacy .NET Remoting server that accepts deserialization of arbitrary object references [CWE-306]. Combined with predictable ObjectURIs and DLL search order weaknesses in the service directory, the design permits unauthenticated attackers to pivot from network reachability to SYSTEM code execution.

Attack Vector

The attack originates over the network. An attacker sends a crafted .NET Remoting request to TCP port 9000, retrieves or writes files via the WebClient proxy, plants a hijacked DLL such as CRYPTBASE.DLL in the MediaWriter application folder, and waits for or forces a service restart to execute code as SYSTEM.

No verified proof-of-concept code is reproduced here. Refer to the GitHub Gist PoC Script for the published exploitation workflow.

Detection Methods for CVE-2026-58127

Indicators of Compromise

Inbound TCP connections to port 9000 from untrusted sources reaching MediaWriter hosts.
Unexpected files written to the PACSgear MediaWriter installation directory, particularly CRYPTBASE.DLL or other DLLs not shipped with the product.
MediaWriter service restarts followed by child processes spawned by PacsgearMediaServer executables running as SYSTEM.

Detection Strategies

Alert on new DLL creation events in the MediaWriter application directory using file integrity monitoring.
Inspect network telemetry for .NET Remoting binary framing patterns targeting port 9000 from non-clinical subnets.
Correlate NT Authority\SYSTEM process launches originating from the MediaWriter service path with prior filesystem writes to the same directory.

Monitoring Recommendations

Enable Windows Sysmon module load logging (Event ID 7) on MediaWriter hosts and hunt for unsigned DLLs loaded by the service.
Capture NetFlow or firewall logs for port 9000 and review any external or lateral connections weekly.
Baseline expected service restart frequency and alert when the MediaWriter service restarts outside change windows.

How to Mitigate CVE-2026-58127

Immediate Actions Required

Restrict TCP port 9000 at the host and network firewall so only trusted management stations can reach the .NET Remoting endpoint.
Audit the MediaWriter installation directory for unauthorized DLLs and remove any files not part of the original vendor build.
Contact Hyland support to obtain fixed builds or vendor guidance for PACSgear MediaWriter 5.2.1 deployments.

Patch Information

At publication, no vendor patch is referenced in the enriched CVE data. Consult the Hyland Product Overview and the VulnCheck Advisory on PACSGear for the latest remediation status.

Workarounds

Block inbound access to TCP port 9000 with a host firewall rule until a vendor patch is available.
Set restrictive Access Control Lists (ACLs) on the MediaWriter application directory to prevent non-administrative accounts from writing DLLs.
Segment MediaWriter hosts onto a dedicated Picture Archiving and Communication System (PACS) VLAN with strict east-west controls.
Disable the MediaWriter service on systems that do not require its remoting functionality.

bash

# Configuration example: block external access to the vulnerable .NET Remoting port on Windows
netsh advfirewall firewall add rule ^
  name="Block PACSgear MediaWriter Remoting 9000" ^
  dir=in ^
  action=block ^
  protocol=TCP ^
  localport=9000 ^
  remoteip=any