PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by explo…

PACSgear PACS Scan version 5.2.1 contains a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-58126. The flaw stems from an exposed .NET Remoting TCP service running on port 22222 via PGImageExchQueue.exe, which requires no authentication. Attackers can exploit this to read and write arbitrary files on the target system. By chaining the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, attackers can achieve full SYSTEM-level code execution upon service restart. The vulnerability requires no credentials, making it highly accessible to remote threat actors. The affected software is a medical imaging product distributed by Hyland under the PACSgear brand. Exploitation could have serious consequences in healthcare environments where PACS systems manage sensitive medical imaging data. A proof-of-concept is publicly available on GitHub, increasing the risk of active exploitation.