Is CVE-2026-58126 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58126 being exploited in the wild.

How severe is CVE-2026-58126?

Critical severity, with a CVSS score of 9.8, published 1 July 2026.

Which products and versions are affected?

Hyland PACSgear PACS Scan 5.2.1.

Is there a fix for CVE-2026-58126?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58126 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58126?

Check whether you run Hyland PACSgear PACS Scan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58126: Hyland PACSgear PACS Scan RCE via .NET Remoting Insecure Deserialization

CVE-2026-58126 · Severity: critical · CVSS 9.8 · Published 2026-07-01

PACSgear PACS Scan is a medical imaging solution used to capture and integrate patient data into electronic health records. A critical security flaw allows an unauthenticated attacker to remotely read or write files on the server and execute malicious code with the highest system privileges. This could lead to the complete compromise of the server, theft of sensitive patient data, or disruption of medical imaging workflows.

Vendors: Hyland.

Quick answers

Is CVE-2026-58126 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58126 being exploited in the wild.
How severe is CVE-2026-58126?: Critical severity, with a CVSS score of 9.8, published 1 July 2026.
Which products and versions are affected?: Hyland PACSgear PACS Scan 5.2.1.
Is there a fix for CVE-2026-58126?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58126 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58126?: Check whether you run Hyland PACSgear PACS Scan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the PGImageExchQueue.exe component, which exposes a .NET Remoting TCP service on port 22222 (ObjectURI: PGImageExchange) without authentication. By exploiting insecure deserialization and missing authentication (CWE-502, CWE-306), a remote attacker can read and write arbitrary files. This primitive can be leveraged for Remote Code Execution (RCE) by placing a malicious DLL (e.g., CRYPTSP.DLL) into the application directory. When the PGImageExchangeQueueSvc.exe service restarts, it attempts to load these missing DLLs, executing the attacker's code with NT Authority\SYSTEM privileges. Exploitation requires network access to the service port but no valid credentials.

Affected products

Hyland PACSgear PACS Scan 5.2.1

Timeline

2026-07-01: disclosed: Public disclosure by researchers from GM Sectec, Corp.
2026-07-01: advisory: CVE-2026-58126 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.