CVE-2026-39907

CVE-2026-39907 is a path traversal and credential theft vulnerability affecting Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604. The vulnerability resides in an unauthenticated WCF SOAP endpoint exposed on TCP port 1208, which fails to properly validate file paths in the ReadLicense action's LFName parameter. This flaw allows remote attackers to submit crafted SOAP requests containing UNC paths to trigger forced outbound SMB connections from the vulnerable server. The attack requires network access to port 1208 but no authentication credentials, representing a network-adjacent attack vector with low complexity. By forcing the server to initiate SMB connections to attacker-controlled systems, threat actors can capture NTLMv2 machine-account hashes. These credentials can subsequently be relayed for privilege escalation or lateral movement within the target network, creating significant exposure to the confidentiality and integrity of networked systems. The vulnerability shows limited current exploitation risk with no known active use in the wild and a low EPSS score of 0.0038, placing it below the median threat distribution. The vulnerability is not currently tracked on CISA's Known Exploited Vulnerabilities catalog, and there is no indication of public exploit code availability or elevated community attention. Organizations should prioritize patching only if they operate the affected Unisys products in exposed network positions.