CVE-2026-23751
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedKofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling techniques to instantiate a remote System.Net.WebClient object and read arbitrary files from the server filesystem, write attacker-controlled files to the server, or coerce NTLMv2 authentication to an attacker-controlled host, enabling sensitive credential disclosure, denial of service, remote code execution, or lateral movement depending on service account privileges and network environment.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceKofax Capture (Tungsten Capture) version 6.0.0.0 exposes a deprecated, unauthenticated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service. The service uses a default, publicly known endpoint identifier, allowing unauthenticated remote attackers to exploit .NET Remoting object unmarshalling to read/write arbitrary files, coerce NTLMv2 authentication, and achieve remote code execution or lateral movement depending on service account privileges.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm Kofax Capture installationCheck for Kofax Capture or Tungsten Capture in installed programs (Programs and Features), or look for installation directories such as C:\Program Files\Kofax\ or C:\Program Files\Tungsten\Capture\. Check Windows Registry under HKLM\SOFTWARE\Kofax or HKLM\SOFTWARE\Tungten for Capture entries.Affected if Kofax Capture or Tungsten Capture is installed
-
Verify installed version is 6.0.0.0Locate the version information in the installation directory (often in an About or version file), or check the product version in Programs and Features. Compare the exact version string to 6.0.0.0.Affected if Installed version is exactly 6.0.0.0 (no other versions are affected per this CVE)
-
Confirm Ascent Capture Service is runningOpen Services (services.msc) and look for a service named 'Ascent Capture Service' or 'Kofax Capture Service'. Alternatively, run 'sc query' or 'Get-Service' PowerShell command to enumerate running services.Affected if The Ascent Capture Service is present and running
-
Check if port 2424 is listeningRun 'netstat -an | findstr :2424' or 'Get-NetTCPConnection -LocalPort 2424' to check if port 2424 is open and bound to a listening service. This port is used by the .NET Remoting HTTP channel.Affected if Port 2424 is listening/open on any network interface (0.0.0.0 or specific IP)
-
Verify .NET Remoting endpoint accessibilityAttempt a basic HTTP request to http://localhost:2424/AscentCapture or use a tool like nmap to probe the endpoint: nmap -p 2424 --script http-title <target> or curl http://<target>:2424/. The service uses a default, publicly known endpoint identifier.Affected if HTTP response is received from port 2424 indicating .NET Remoting service is accessible
A system is affected if Kofax Capture version 6.0.0.0 is installed with the Ascent Capture Service running and port 2424 open/exposed, allowing unauthenticated .NET Remoting access.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataImmediately block port 2424 at the network perimeter or disable the Ascent Capture Service if not required; network segmentation can limit exposure while a vendor patch is developed and tested.
- Consultation8.0 h
- Implementation12.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,608.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-23751 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-23751 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data