CVE-2026-26142
CVE-2026-26142 is a critical vulnerability (CVSS 9.8) in Nuance PowerScribe where deserialization of untrusted data allows an unauthenticated attacker to execute arbitrary code over the network. It affects PowerScribe 360 versions 4.0.0 through 4.0.9 and PowerScribe One versions 2019.1 through 2019.5. No official fix, vendor patch, or known exploit is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Nuance PowerScribe 360 4.0.0-4.0.9 and PowerScribe One 2019.1-2019.5
Real-world impact
An attacker can remotely execute code with the privileges of the affected service, potentially leading to full system compromise.
Why this severity
The CVSS v3.1 score of 9.8 reflects a network‑adjacent attack with low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory