CVE-2026-23751 — AI Deep Analysis Summary

🚨 **Essence**: Kofax Capture has a critical **Access Control Error**. It exposes a .NET Remoting HTTP channel without authentication.…

🛡️ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function). The flaw lies in exposing a .NET Remoting endpoint via HTTP that requires **NO identity verification**.…

🏢 **Affected Vendor**: Tungsten Automation (Kofax). 📦 **Product**: Kofax Capture. 📅 **Version**: Specifically **6.0.0.0**. If you run this version, you are in the danger zone! ⚠️

💀 **Attacker Capabilities**: 1. 📂 **Read**: Extract ANY file from the server filesystem. 2. ✍️ **Write**: Drop attacker-controlled files anywhere. 3.…

🔓 **Exploitation Threshold**: **EXTREMELY LOW**. - **Auth**: None required (PR:N). - **Network**: Remote (AV:N). - **UI**: No user interaction needed (UI:N). - **Complexity**: Low (AC:L).…

💣 **Public Exploit**: Yes. A technical description and PoC are available on GitHub (Gist by VAMorales). Third-party advisories confirm the exploitability. Wild exploitation is highly likely given the low barrier. 🌍

🔍 **Self-Check**: Scan for open **.NET Remoting HTTP channels** on default ports. Look for unauthenticated access to Kofax Capture endpoints.…

🩹 **Official Fix**: The advisory references Tungsten Automation documentation. You must check the **Kofax Capture 11.1.0+** documentation or vendor portal for patches.…

🚧 **No Patch? Workaround**: 1. 🚫 **Block Ports**: Firewall rules to block external access to .NET Remoting ports. 2. 🔒 **Disable Service**: If not needed, disable the HTTP channel. 3.…

🔥 **Urgency**: **CRITICAL (P1)**. CVSS Score is **9.1** (High). Remote code execution/file manipulation without auth is a nightmare. Patch or mitigate **IMMEDIATELY**. Do not wait! ⏳