CVE-2026-23751 is a critical vulnerability in Tungsten Automation's Kofax Capture 6.0.0.0 where a deprecated .NET Remoting HTTP channel exposed on port 2424 via the Ascent Capture Service lacks authentication and uses a default, publicly known endpoint identifier. This allows unauthenticated attackers to perform .NET Remoting object unmarshalling attacks to instantiate remote objects like System.Net.WebClient, enabling arbitrary file read/write on the server, NTLMv2 credential relay, and potentially denial of service, remote code execution, or lateral movement depending on the service account privileges and network environment. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-441 (Unintended Proxy or Intermediary). There is no vendor advisory or patch information available as of the publication date.

An unauthenticated remote attacker can exploit this vulnerability to read and write arbitrary files on the affected server, potentially disclose sensitive credentials via NTLMv2 relay, cause denial of service, execute remote code, or move laterally within the network. The severity is critical due to the lack of authentication and the ability to perform multiple impactful actions depending on the environment and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to port 2424 on the affected server to trusted hosts only and consider disabling or blocking the deprecated .NET Remoting HTTP channel if possible. Monitor for unusual activity related to this service. Do not rely on generic mitigations; follow vendor updates closely.