PACS Gear PACS Scan Unauth File Read/Write & RCE via .NET Remoting (CVE-2026-58126)

Vulnerability Overview Vulnerability Title: PACSGEAR PACS Scan - Unauthorized Arbitrary File Read/Write + Remote Code Execution (RCE) via .NET Remoting Disclosure Date: January 7, 2026 CVE ID: CVE-2026-58126 Vulnerability Authors: Victor A. Morales and Jan A. Rodriguez (GM Sectec, Corp.) Vendor Homepage: Hyland Affected Versions: 5.2.1 Description: PACS Gear PACS Scan exposes a .NET Remoting service on all interfaces, registered on port 22222 by the executable . By modifying the to and utilizing a code-write method discovered through research on unmarshalling techniques, arbitrary read and write access to internal system files can be achieved. Furthermore, arbitrary file reading can be accomplished by forcing a connection to the correct host and port using a custom channel receiver. This vulnerability only requires knowledge of a valid , is open to all instances by default, and requires no authentication. To achieve RCE, it was observed that the executable runs with NT Authority\SYSTEM privileges and attempts to load multiple missing dynamic link library (DLL) file paths (e.g., ), creating opportunities for DLL hijacking. Combined with the .NET Remoting Arbitrary File Read (AFR) primitive, this allows for remote code execution. Scope of Impact Affected Versions: 5.2.1 Affected Service: PACS Gear PACS Scan Affected Port: 22222 Affected Privileges: NT Authority\SYSTEM Remediation 1. Restart Service: Restart the affected service. 2. System Restart: A system restart or an automatic restart triggered by a dependency service failure can be used. 3. Low-Privilege Accounts: These tasks cannot be executed by low-privilege accounts. Exploit Code Custom Channel Fix Code PowerShell TCP Reverse Connection Script Compilation and Linking Commands Upload Malicious DLL Commands Summary This vulnerability allows attackers to achieve arbitrary file read/write and remote code execution through an unauthenticated .NET Remoting service. Remediation steps include restarting the service, performing a system restart, or relying on automatic restarts triggered by dependency service failures. The exploit code includes custom channel fix code, a PowerShell TCP reverse connection script, and compilation/linking commands.

Goal Reached Thanks to every supporter — we hit 100%!

PACS Gear PACS Scan Unauth File Read/Write & RCE via .NET Remoting (CVE-2026-58126)