CVE-2026-26222

DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE

State: Published
Severity: 10.0 Critical
Published: Feb 24, 2026
Updated: Feb 27, 2026
Reserved: Feb 11, 2026

Description

Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck

Weaknesses

CWE-502 Deserialization of Untrusted Data
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Altec DocLinkBeyond Limits Inc.	4.0.336.0Affected

References

https://doclinkai.com/product
https://www.vulncheck.com/advisories/doclink-net-remoting-unauthenticated-arbitrary-file-read-write-rcethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.