CVE-2026-26142: Nuance PowerScribe Remote Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-09-24
Weakness: CWE-502

Description

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

Affected products

Microsoft Nuance Powerscribe 360: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+4)
Microsoft Nuance Powerscribe One: 2019.1, 2019.2, 2019.3, 2019.4, 2019.5, 2019.6 (+6)
Microsoft Nuance PowerScribe 360 4.0: from 4.0 before 7.0.11.49 — fixed in 7.0.11.49
Microsoft Nuance PowerScribe 360 version 4.0.1: from 4.0.1 before 7.0.111.68 — fixed in 7.0.111.68
Microsoft Nuance PowerScribe 360 version 4.0.2: from 4.0.2 before 7.0.154.18 — fixed in 7.0.154.18
Microsoft Nuance PowerScribe 360 version 4.0.3: from 4.0.3 before 7.0.197.10 — fixed in 7.0.197.10
Microsoft Nuance PowerScribe 360 version 4.0.4: from 4.0.4 before 7.0.212.10 — fixed in 7.0.212.10
Microsoft Nuance PowerScribe 360 version 4.0.5: from 4.0.5 before 7.0.243.19 — fixed in 7.0.243.19
Microsoft Nuance PowerScribe 360 version 4.0.6: from 4.0.6 before 7.0.277.28 — fixed in 7.0.277.28
Microsoft Nuance PowerScribe 360 version 4.0.7: from 4.0.7 before 7.0.316.12 — fixed in 7.0.316.12
Microsoft Nuance PowerScribe 360 version 4.0.8: from 4.0.8 before 7.0.427.15 — fixed in 7.0.427.15
Microsoft Nuance PowerScribe 360 version 4.0.9: from 4.0.9 before 7.0.528.24 — fixed in 7.0.528.24
Microsoft Nuance PowerScribe One version 2019.1: from 2019.1 before 2019.1.96.6 — fixed in 2019.1.96.6
Microsoft Nuance PowerScribe One version 2019.10: from 2019.10 before 2019.10.36.14 — fixed in 2019.10.36.14
Microsoft Nuance PowerScribe One version 2019.2: from 2019.2 before 2019.2.9.11 — fixed in 2019.2.9.11
Microsoft Nuance PowerScribe One version 2019.3: from 2019.3 before 2019.3.16.21 — fixed in 2019.3.16.21
Microsoft Nuance PowerScribe One version 2019.4: from 2019.4 before 2019.4.9.17 — fixed in 2019.4.9.17
Microsoft Nuance PowerScribe One version 2019.5: from 2019.5 before 2019.5.14.40 — fixed in 2019.5.14.40
Microsoft Nuance PowerScribe One version 2019.6: from 2019.6 before 2019.6.36.40 — fixed in 2019.6.36.40
Microsoft Nuance PowerScribe One version 2019.7: from 2019.7 before 2019.7.107.26 — fixed in 2019.7.107.26
Microsoft Nuance PowerScribe One version 2019.8: from 2019.8 before 2019.8.43.19 — fixed in 2019.8.43.19
Microsoft Nuance PowerScribe One version 2019.9: from 2019.9 before 2019.9.31.23 — fixed in 2019.9.31.23
Microsoft PowerScribe One version 2023.1 SP2 Patch 11: from 2023.1 before 2023.2.3054 — fixed in 2023.2.3054
Microsoft PowerScribe One version 2023.1 SP3 Patch 6: from 2023.1 before 2023.3.9072 — fixed in 2023.3.9072

How to fix

Upgrade to a fixed version: Microsoft Nuance PowerScribe 360 4.0 7.0.11.49; Microsoft Nuance PowerScribe 360 version 4.0.1 7.0.111.68; Microsoft Nuance PowerScribe 360 version 4.0.2 7.0.154.18; Microsoft Nuance PowerScribe 360 version 4.0.3 7.0.197.10; Microsoft Nuance PowerScribe 360 version 4.0.4 7.0.212.10; Microsoft Nuance PowerScribe 360 version 4.0.5 7.0.243.19; Microsoft Nuance PowerScribe 360 version 4.0.6 7.0.277.28; Microsoft Nuance PowerScribe 360 version 4.0.7 7.0.316.12; Microsoft Nuance PowerScribe 360 version 4.0.8 7.0.427.15; Microsoft Nuance PowerScribe 360 version 4.0.9 7.0.528.24; Microsoft Nuance PowerScribe One version 2019.1 2019.1.96.6; Microsoft Nuance PowerScribe One version 2019.10 2019.10.36.14. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26142

Get alerted when CVE-2026-26142 or the next vulnerability affects your stack