CVE-2026-39906

CVE-2026-39906 affects Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604, which expose a deprecated .NET Remoting TCP channel that can be exploited by remote attackers without authentication. The vulnerability allows attackers to extract NTLMv2 machine-account hashes by supplying Windows UNC paths through object-unmarshalling techniques, enabling potential credential capture and misuse. The attack is network-accessible with low complexity, as it requires only the ability to send specially crafted requests to the exposed channel. Once captured, the NTLMv2 hashes can be relayed to other systems for privilege escalation or lateral movement within the network, depending on environmental configuration and patch status. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community attention, with an EPSS score of 0.0023 indicating very low real-world exploitation probability at present.