Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23751 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Tungstenautomation (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Proxy (T1090); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and AC-16 (Security and Privacy Attributes) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23751 affects Kofax Capture, now referred to as Tungsten Capture, specifically version 6.0.0.0, with other versions potentially vulnerable. The vulnerability stems from the Ascent Capture Service exposing a deprecated .NET Remoting HTTP channel on port 2424, which is accessible without authentication and uses a default, publicly known endpoint identifier. This misconfiguration enables exploitation through .NET Remoting object unmarshalling techniques, as scored at CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and linked to CWEs-306 (Missing Authentication for Critical Function) and CWE-441 (Unintended Proxy or Intermediary).
An unauthenticated remote attacker can exploit this by instantiating a remote System.Net.WebClient object via the exposed channel. This allows reading arbitrary files from the server filesystem, writing attacker-controlled files to the server, or coercing NTLMv2 authentication to an attacker-controlled host. Depending on the privileges of the service account and the network environment, successful exploitation can lead to sensitive credential disclosure, denial of service, remote code execution, or lateral movement.
Advisories and resources, including the Tungsten Automation documentation, a GitHub gist detailing the issue, and a VulnCheck advisory, provide additional technical details on the vulnerability, such as proof-of-concept exploitation steps for file read/write and SMB coercion via .NET Remoting. Practitioners should consult these for guidance on identification and potential workarounds, as no specific patch details are outlined in the core CVE information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25228
Vulnerability Data
Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly…
more
known endpoint identifier. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling techniques to instantiate a remote System.Net.WebClient object and read arbitrary files from the server filesystem, write attacker-controlled files to the server, or coerce NTLMv2 authentication to an attacker-controlled host, enabling sensitive credential disclosure, denial of service, remote code execution, or lateral movement depending on service account privileges and network environment.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates unique identification and authentication of users before access to functions requiring identity.
Extends the same authentication requirement to non-organizational users accessing critical functionality.
Requires authentication of services before they can invoke or expose critical functions.
Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.
Associating and preserving security attributes such as original source identity prevents the loss of provenance that creates the confused deputy.
Information flow enforcement requires preserving and checking source attributes before forwarding requests outside the trust boundary.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.
Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.
Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.
Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. prevents CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-306
RHEL 7 (2 rules)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. prevents CWE-306
RHEL 8 (2 rules)
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-306
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. prevents CWE-306