Is CVE-2026-26338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26338 being exploited in the wild.

How severe is CVE-2026-26338?

Critical severity, with a CVSS score of 9.8, published 19 February 2026.

Which products and versions are affected?

Hyland Alfresco Community (Transform Core) < 5.3.0; Hyland Alfresco Transformation Service (Enterprise) < 4.3.0.

Is there a fix for CVE-2026-26338?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26338 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26338?

Check whether you run Hyland Alfresco Community (Transform Core) or Hyland Alfresco Transformation Service (Enterprise) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26338: Hyland Alfresco Transformation Service SSRF in document processing

Q: Is there a fix for CVE-2026-26338?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-26338 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-26338?

Check whether you run Hyland Alfresco Community (Transform Core) or Hyland Alfresco Transformation Service (Enterprise) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26338 · Severity: critical · CVSS 9.8 · Published 2026-02-19

Hyland Alfresco Transformation Service, a component used to convert documents into different formats, contains a security flaw that allows unauthorized individuals to perform Server-Side Request Forgery (SSRF). By exploiting this, an attacker could force the server to make requests to internal systems that are not intended to be accessible from the outside. This could lead to the exposure of sensitive internal data, unauthorized access to internal services, or further disruption of corporate operations.

Vendors: Hyland.

Quick answers

Is CVE-2026-26338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26338 being exploited in the wild.
How severe is CVE-2026-26338?: Critical severity, with a CVSS score of 9.8, published 19 February 2026.
Which products and versions are affected?: Hyland Alfresco Community (Transform Core) < 5.3.0; Hyland Alfresco Transformation Service (Enterprise) < 4.3.0.
Is there a fix for CVE-2026-26338?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26338 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26338?: Check whether you run Hyland Alfresco Community (Transform Core) or Hyland Alfresco Transformation Service (Enterprise) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in the Hyland Alfresco Transformation Service within its document processing functionality. The flaw allows an unauthenticated remote attacker to send specially crafted requests that the server will then execute, potentially targeting internal network resources or metadata services. The vulnerability affects both the Enterprise version (ATS) and the Community version (Transform Core). Patches have been released in Alfresco Transformation Service version 4.3.0 and Alfresco Community (Transform Core) version 5.3.0.

Affected products

Hyland Alfresco Transformation Service (Enterprise) < 4.3.0
Hyland Alfresco Community (Transform Core) < 5.3.0

Timeline

2026-02-19: disclosed
2026-02-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.