CVE-2026-39906 affects Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 by exposing a deprecated .NET Remoting TCP channel. This exposure permits remote unauthenticated attackers to exploit object unmarshalling to supply a Windows UNC path as a target file argument, causing the leakage of NTLMv2 machine-account hashes. These hashes can then be captured and relayed to other hosts, which may lead to privilege escalation or lateral movement depending on network configuration and patch levels. The vulnerability is categorized under CWE-441 (Unintended Proxy or Intermediary, also known as 'Confused Deputy'). There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

The vulnerability allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes from affected versions of WebPerfect Image Suite. Captured hashes can be relayed to other hosts, potentially enabling attackers to escalate privileges or move laterally within a network. The impact depends on the network environment and existing security controls. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the affected service and monitor for unusual authentication relay activity. Avoid exposing the affected versions to untrusted networks. Follow vendor communications for updates on patches or official mitigations.