Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26336 Unauthenticated File Read Vulnerability in Hyland Alfresco via Resource Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26336
Post summary
The text announces CVE‑2026‑26336, a vulnerability allowing unauthenticated file reads in Hyland Alfresco via a resource endpoint, without providing PoC, exploit code or patch information.
CVE-2026-26336 affects Alfresco @Share (unauthenticated arbitrary file read) If you run: • ACS 7.4.2 → upgrade to 7.4.2.6 • 23.6.x → 23.6.1 • 25.1/25.2 → 25.3 • Community <25.3 → 25.3 Details: https://connect.hyland.com/t5/alfresco-blog/cve-2026-26336-unauthenticated-arbitrary-file-read-in-alfresco/ba-p/496550
Post summary
The post announces CVE‑2026‑26336, an unauthenticated arbitrary file read in Alfresco @Share, and supplies specific version upgrade instructions to mitigate the issue.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hyland | alfresco_content_services | - | - | - |
| App | hyland | alfresco_content_services | - | - | - |