PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

published 2026-07-01 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-41036

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\SYSTEM upon service restart.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 4 mo ago (2026-07-01)

Exploit prediction

1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gist.github.com https://gist.github.com/VAMorales/6dc232729cdd517fa30d581fbcd98d8f referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Hyland PACSgear PACS Scan

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality
CWE-502 Deserialization of Untrusted Data

References

gist.github.com /VAMorales/6dc232729cdd517fa30d581fbcd98d8f
technical-description, exploit, third-party-advisory
hyland.com /en/solutions/products/pacsgear
product
vulncheck.com /advisories/pacsgear-pacs-scan-unauthenticated-rce-via-net-remoting-tcp-service
third-party-advisory, vdb-entry

Sources

CVE List CVE-2026-58126
NVD CVE-2026-58126

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary