CVE-2026-26222
Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServe...
Affects 1 product across 1 vendor.
Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.
Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
Altec DocLink version 4.0.336.0, now maintained by Beyond Limits Inc., exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP, which can be exploited by remote attackers to read arbitrary files from the system.
BSID: BS-2026-GLOBAL-275007-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-26222?
What is the CVSS score for CVE-2026-26222?
Is CVE-2026-26222 actively exploited?
How do I remediate CVE-2026-26222?
What systems are affected by CVE-2026-26222?
| CVE ID | CVE-2026-26222 |
|---|---|
| BSID | BS-2026-GLOBAL-275007-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-02-24 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.
Source: NIST NVD / MITRE CVE Database
The vulnerability lies in the Altec.RDCHostService.exe service, which uses the ObjectURI 'doclinkServer.soap'. This service does not require authentication and is susceptible to unsafe object unmarshalling, allowing attackers to perform unauthorized file operations.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Beyond | Altec Doclink | 4.0.336.0 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | de76bb1eddce833cc47df66306788e55d4bc1f0bf8109f711c56a03dc4391834bdf1d4881050c66200370fdbdb4e33805095cf6d7059fdbe0804a5bc5b06192a |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →