Is CVE-2026-26337 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26337 being exploited in the wild.

How severe is CVE-2026-26337?

High severity, with a CVSS score of 8.2, published 19 February 2026.

Which products and versions are affected?

Hyland Alfresco Community < 5.3.0; Hyland Alfresco Transformation Service < 4.3.0.

Is there a fix for CVE-2026-26337?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26337 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26337?

Check whether you run Hyland Alfresco Community or Hyland Alfresco Transformation Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26337: Hyland Alfresco Transformation Service path traversal and SSRF

Q: Is there a fix for CVE-2026-26337?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-26337 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-26337?

Check whether you run Hyland Alfresco Community or Hyland Alfresco Transformation Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26337 · Severity: high · CVSS 8.2 · Published 2026-02-19

Hyland Alfresco Transformation Service, a component used to convert documents between different formats, contains a security flaw that allows unauthorized individuals to access sensitive files. By exploiting this vulnerability, an attacker could read internal system files or use the server to launch further attacks against other internal systems. This could lead to the exposure of confidential business data or provide a foothold for deeper network penetration.

Vendors: Hyland.

Quick answers

Is CVE-2026-26337 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26337 being exploited in the wild.
How severe is CVE-2026-26337?: High severity, with a CVSS score of 8.2, published 19 February 2026.
Which products and versions are affected?: Hyland Alfresco Community < 5.3.0; Hyland Alfresco Transformation Service < 4.3.0.
Is there a fix for CVE-2026-26337?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26337 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26337?: Check whether you run Hyland Alfresco Community or Hyland Alfresco Transformation Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An absolute path traversal vulnerability (CWE-36) exists in Hyland Alfresco Transformation Service and Alfresco Community (Transform Core). The flaw allows a remote, unauthenticated attacker to bypass path validation logic by providing absolute file paths to the service. This can be leveraged to perform arbitrary file reads from the underlying host or initiate Server-Side Request Forgery (SSRF) attacks. The vulnerability is addressed in Alfresco Transformation Service (Enterprise) version 4.3.0 and Alfresco Community (Transform Core) version 5.3.0.

Affected products

Hyland Alfresco Transformation Service (Enterprise) < 4.3.0
Hyland Alfresco Community (Transform Core) < 5.3.0

Timeline

2026-02-19: disclosed
2026-02-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.