# CVE-2026-26339: Hyland Alfresco Transformation Service argument injection RCE

Source: https://junglewise.ai/threats/cve-2026-26339-hyland-alfresco-transformation-service-argument-injection-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-26339 · Severity: critical · CVSS 9.8 · Published 2026-02-19

Hyland Alfresco Transformation Service, a component used to convert and process documents within the Alfresco content management platform, contains a critical security flaw. An unauthenticated attacker can exploit this vulnerability to remotely take control of the server. This could lead to a total compromise of the system, including unauthorized access to sensitive documents, data theft, or disruption of business operations.

Vendors: [Hyland](https://junglewise.ai/threats/vendors/hyland).

## Quick answers

**Is CVE-2026-26339 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26339 being exploited in the wild.

**How severe is CVE-2026-26339?** Critical severity, with a CVSS score of 9.8, published 19 February 2026.

**Which products and versions are affected?** Hyland Alfresco Community < 5.2.4; Hyland Alfresco Transformation Service < 4.2.3.

**Is there a fix for CVE-2026-26339?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26339 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-26339?** Check whether you run Hyland Alfresco Community, Hyland Alfresco Transformation Service, Hyland Alfresco Transform Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An argument injection vulnerability exists in the document processing functionality of Hyland Alfresco Transformation Service. The flaw allows a remote, unauthenticated attacker to inject malicious arguments into system commands executed by the service during file transformations. By sending a specially crafted request over the network, an attacker can achieve full remote code execution (RCE) on the underlying host. The vulnerability affects both the Enterprise Transformation Service (versions prior to 4.2.3) and the Community Transform Core (versions prior to 5.2.4). While the advisory also references CWE-918 (SSRF), the primary impact is documented as RCE.

## Affected products

- Hyland Alfresco Transformation Service (Enterprise) < 4.2.3
- Hyland Alfresco Community (Transform Core) < 5.2.4

## Timeline

- 2026-02-19: disclosed: Initial publication of the vulnerability details.
- 2026-02-19: advisory: Vendor advisory published by Hyland.

## References

- [https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551](https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551)
- [https://www.hyland.com/en/solutions/products/alfresco-platform](https://www.hyland.com/en/solutions/products/alfresco-platform)
- [https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-argument-injection-rce](https://www.vulncheck.com/advisories/hyland-alfresco-transformation-service-argument-injection-rce)

## Related threats

- [Hyland Alfresco Transformation Service path traversal and SSRF](https://junglewise.ai/threats/cve-2026-26337-hyland-alfresco-transformation-service-path-traversal-and-ssrf)