Hyland Alfresco Transformation Service (Enterprise) contains an SSRF vulnerability (CWE-918) that permits unauthenticated attackers to leverage the document processing feature to cause the server to send crafted requests to internal or external resources. This can potentially lead to information disclosure or interaction with internal systems. The vulnerability is identified as CVE-2026-26338 with a CVSS 4.0 base score of 6.9, reflecting network attack vector, no privileges required, no user interaction, and low to low integrity and availability impacts. No vendor patch or fix has been disclosed yet.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may allow the attacker to access internal resources or services that are otherwise inaccessible, potentially leading to information disclosure or further attacks within the internal network. The impact is rated medium severity based on the CVSS score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Alfresco Transformation Service and monitor for unusual request patterns related to document processing. Avoid exposing the service to untrusted networks if possible.