Critical Kofax Capture RCE Vulnerability: Unauthenticated Access to Files and NTLMv2 Coercion

The National Vulnerability Database has detailed CVE-2026-23751, a critical vulnerability in Kofax Capture, now known as Tungsten Capture, version 6.0.0.0. This flaw exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service. Crucially, this service is accessible without authentication and leverages a publicly known default endpoint identifier.

An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling. This allows for the instantiation of a remote System.Net.WebClient object, enabling attackers to read arbitrary files, write attacker-controlled files to the server, or coerce NTLMv2 authentication to an attacker-controlled host. The National Vulnerability Database assigns this a CVSS score of 9.8 (Critical), highlighting the severe implications.

This vulnerability presents a clear path to sensitive credential disclosure, denial of service, remote code execution, or lateral movement. The ultimate impact hinges on the privileges of the service account and the specific network environment. This isn’t just a theoretical risk; it’s a direct route to significant compromise if left unaddressed.