CVE-2026-26222 is a critical flaw (CVSS 9.8) in Altec DocLink version 4.0.336.0, now maintained by Beyond Limits Inc. An unauthenticated .NET Remoting service lets a remote attacker read and write files on the server. The record names no fixed version, so contact the vendor and isolate the service first.
What's affected
The NVD record and the VulnCheck advisory list one affected version: Altec DocLink 4.0.336.0. The software is described as now maintained by Beyond Limits Inc.
The flaw sits in the Altec.RDCHostService.exe service, which publishes a .NET Remoting endpoint under the object URI doclinkServer.soap. It is reachable over TCP and over HTTP with SOAP.
Neither source names a patched release. Do not assume that a newer build fixes it until the vendor says so in writing.
How to check if you're exposed
Start by finding out whether the service runs anywhere in your estate.
On Windows hosts, check for the process and for listeners:
Get-Process -Name Altec.RDCHostService -ErrorAction SilentlyContinue
Get-NetTCPConnection -State Listen | Where-Object OwningProcess -in (Get-Process Altec.RDCHostService -ErrorAction SilentlyContinue).Id
The second command shows which ports the service has open. If any of them are reachable from a network segment you do not control, treat the host as exposed.
Check the installed version in Programs and Features. Only 4.0.336.0 is named in the advisory, but ask the vendor about other builds.
What to do now
- Ask Beyond Limits Inc. for a fixed build or a written mitigation, and record the answer. The advisory links the DocLink site as the vendor contact.
- Block the remoting ports at the host firewall and at the network edge so only the machines that must talk to the service can reach it. Do not leave it open to the internet.
- If the DocLink server also hosts a web application under IIS, review which folders the service account can write to. The advisory says writable paths that are web accessible turn a file write into code execution.
- Run the service under a low privilege account and block outbound SMB (TCP 445) from the server, since the advisory describes coerced SMB authentication through UNC paths.
- Review logs on the host for unexpected files in web accessible folders and for unfamiliar outbound connections. Treat any unexplained file as an incident until proven otherwise.
Why it matters
The advisory ties this to two weakness classes. CWE-502 is deserialization of untrusted data: the remoting service rebuilds objects from what a caller sends, with no check on who is calling. CWE-918 is server side request forgery, which here shows up as the service following UNC paths and reaching out over SMB.
The combination is what makes it serious. Reading arbitrary files exposes secrets. Writing arbitrary files into a folder that IIS serves can lead to remote code execution, or to denial of service if an important file is overwritten. The record is not on the CISA Known Exploited Vulnerabilities list.
.NET Remoting is an old technology and Microsoft does not recommend it for new work. A service that exposes it to a network without authentication is a pattern to look for in any legacy Windows application.
Quick check
Is CVE-2026-26222 exploited in the wild?
The record's KEV flag is false, and nothing in the advisory says it is being exploited. A public advisory exists, so isolate the service anyway.
Is there a fixed version?
None is named in the record or the VulnCheck advisory. Ask the vendor, Beyond Limits Inc., and record the answer.
Sources
- VulnCheck advisory for DocLink .NET Remoting
- DocLink vendor site (listed in the record; it blocked automated access when we tried it)
- NVD record for CVE-2026-26222
Last reviewed: 19 October 2026.
