CVE-2026-39907 is an external control of file name or path vulnerability in Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604. The product exposes an unauthenticated WCF SOAP endpoint on TCP port 1208 that processes the ReadLicense action's LFName parameter without sanitization. Attackers can exploit this by submitting crafted UNC paths, forcing the server to initiate SMB connections to attacker-controlled hosts. This triggers the leakage of NTLMv2 machine-account hashes, which may be used in credential relay attacks for privilege escalation or lateral movement. The vulnerability is classified under CWE-73 (External Control of File Name or Path). There is no vendor advisory or patch currently available, and the product is not a cloud service, so remediation depends on vendor action or other mitigations.

The vulnerability allows unauthenticated remote attackers to cause the affected server to initiate outbound SMB connections with attacker-controlled UNC paths, resulting in the leakage of NTLMv2 machine-account hashes. These leaked credentials can be relayed to escalate privileges or move laterally within the network, potentially compromising additional systems. The impact is rated high with a CVSS score of 7, indicating significant risk if exploited. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, organizations should monitor Unisys advisories for updates. Until a fix is available, consider restricting network access to the affected TCP port 1208 and monitoring for unusual SMB outbound connections to reduce exposure. Avoid exposing the WCF SOAP endpoint to untrusted networks where possible.