CVE-2026-39907 is a critical flaw (CVSS 10.0) in Unisys WebPerfect Image Suite 3.0.3960.22810 and 3.0.3960.22604. An unauthenticated WCF SOAP endpoint on TCP port 1208 accepts unsanitized file paths in the ReadLicense action, which can leak NTLMv2 machine account hashes. No fixed version is confirmed.
What's affected
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 are affected. The affected endpoint listens on TCP port 1208 according to the record.
The VulnCheck advisory I checked gives no patched version or vendor statement. Ask Unisys directly, using the product page linked below.
How to check if you're exposed
Look for the product on your servers and compare the version:
Get-CimInstance Win32_Product | Where-Object Name -like "*WebPerfect*"
Then see whether the service port is reachable from networks that should not reach it, using your firewall rules or an internal port scan.
What to do now
- Identify every host that runs WebPerfect Image Suite and its version.
- Contact Unisys for a fix or guidance and record the answer.
- Restrict network access to the service to the systems that need it.
- As general hardening, block outbound SMB (TCP 445) from servers to untrusted destinations.
- Review whether machine account hashes could be relayed in your network, and enable relay protections such as SMB signing where supported.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-73 (External Control of File Name or Path). The record says the LFName parameter of the ReadLicense action accepts a path that can make the server open an outbound SMB connection. The leaked hash can then be captured and, depending on network configuration and patch level, relayed to other hosts for privilege escalation or lateral movement.
The weakness is a service that does what it is told with a path it should not trust, and does it without authentication. The record does not flag this CVE as exploited in the wild.
Quick check
Is there a patch?
The sources checked do not name one. Contact Unisys.
Why does a hash leak matter?
The record says it can be relayed for privilege escalation or lateral movement.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
