Hyland Alfresco Transformation Service (Enterprise) contains a CWE-918 SSRF vulnerability (CVE-2026-26339) that enables unauthenticated attackers to perform remote code execution via argument injection in the document processing feature. The vulnerability is exploitable remotely without authentication or user interaction, with high impact on confidentiality, integrity, and availability. The affected version is indicated as '=0', but no further version details or patches are provided. No known exploits are reported in the wild as of the publication date.

Successful exploitation results in remote code execution on the affected system, compromising confidentiality, integrity, and availability. The vulnerability requires no privileges or user interaction, making it highly dangerous if exploited. This could allow attackers to fully control the impacted service and potentially pivot within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the Alfresco Transformation Service and monitor for suspicious activity related to document processing requests.