CVE-2026-21665Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses deprecated .NET Remoting TCP channels that allow unsafe deserialization of untrusted data. When these services are exposed to an untrusted network in a client-managed deployment, an unauthenticated attacker can achieve remote code execution. Version 2021.2.4 is no longer supported by Fiserv. Customers should upgrade to a currently supported release (2025.1 or later) and ensure that .NET Remoting service ports are not exposed beyond trusted network boundaries. This CVE documents behavior observed in a client-hosted deployment running an unsupported legacy version of Originate Loans Peripherals with .NET Remoting ports exposed to an untrusted network. This is not a default or supported configuration. Customers running legacy versions should upgrade to a currently supported release and ensure .NET Remoting ports are restricted to trusted network segments. The finding does not apply to Fiserv-hosted environments.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-02-24: 2Technical Details · 2026-02-24: 202-24
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-21665 Remote Code Execution in Fiserv Originate Loans Peripherals 2021.2.4 via .NET Remoting https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-21665

    Post summary

    A Remote Code Execution vulnerability (CVE-2026-21665) was disclosed for Fiserv Originate Loans Peripherals 2021.2.4 via .NET Remoting, with no mention of PoC, exploit, or patch.

    11010183
    4.0K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-21665 The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses deprecated .… https://www.cve.org/CVERecord?id=CVE-2026-21665

    Post summary

    The post references CVE-2026-21665, noting a deprecated component in an unsupported Fiserv product version, but offers no further technical details, exploit code, or mitigation information.

    11000284
    56.5K followersView on X

Explore more