CVE-2026-58126

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\SYSTEM upon service restart.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/VAMorales/6dc232729cdd517fa30d581fbcd98d8f	Exploit Third Party Advisory
https://www.hyland.com/en/solutions/products/pacsgear	Product
https://www.vulncheck.com/advisories/pacsgear-pacs-scan-unauthenticated-rce-via-net-remoting-tcp-service	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:hyland:pacsgear:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) PACSgear PACS Scan 5.2.1 contiene una vulnerabilidad de ejecución remota de código no autenticada que permite a atacantes remotos leer y escribir archivos arbitrarios explotando un servicio TCP de .NET Remoting expuesto en el puerto 22222 a través de PGImageExchQueue.exe sin ningún requisito de autenticación. Los atacantes pueden encadenar la primitiva de escritura de archivos arbitrarios con secuestro de DLL en PGImageExchangeQueueSvc.exe, que carga DLLs faltantes como CRYPTSP.DLL desde el directorio de la aplicación, para lograr la ejecución remota de código como NT Authority\SYSTEM al reiniciar el servicio.

Information

Published : 2026-07-01 16:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-58126

Mitre link : CVE-2026-58126

CVE.ORG link : CVE-2026-58126

JSON object : View

Products Affected

hyland

pacsgear

CWE

CWE-306

Missing Authentication for Critical Function

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-58126", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58126", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T16:05:51.219022Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Hyland", "product": "PACSgear PACS Scan", "versions": [{"status": "affected", "version": "5.2.1", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-07-01T16:16:51.283", "references": [{"url": "https://gist.github.com/VAMorales/6dc232729cdd517fa30d581fbcd98d8f", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.hyland.com/en/solutions/products/pacsgear", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/pacsgear-pacs-scan-unauthenticated-rce-via-net-remoting-tcp-service", "tags": ["Third Party Advisory", "VDB Entry"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\\SYSTEM upon service restart."}, {"lang": "es", "value": "PACSgear PACS Scan 5.2.1 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo no autenticada que permite a atacantes remotos leer y escribir archivos arbitrarios explotando un servicio TCP de .NET Remoting expuesto en el puerto 22222 a trav\u00e9s de PGImageExchQueue.exe sin ning\u00fan requisito de autenticaci\u00f3n. Los atacantes pueden encadenar la primitiva de escritura de archivos arbitrarios con secuestro de DLL en PGImageExchangeQueueSvc.exe, que carga DLLs faltantes como CRYPTSP.DLL desde el directorio de la aplicaci\u00f3n, para lograr la ejecuci\u00f3n remota de c\u00f3digo como NT Authority\\SYSTEM al reiniciar el servicio."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hyland:pacsgear:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9670099-1015-4BD1-8237-5825B5C762C1", "versionEndIncluding": "5.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}