Unisys vulnerabilities
We track 3 vulnerabilities in Unisys products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 14, 2026.
Latest Unisys vulnerabilities
- 10.0 Critical severity
WebPerfect Image Suite: External Control of File Name or Path
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allowing remote attackers to trigger SMB con
- 10.0 Critical severity
WebPerfect Image Suite: Unintended Proxy or Intermediary
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument
- 8.8 High severity
Data Exchange Management Studio: Cross-Site Request Forgery
Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.