Read the docs
TI-2025-24307 Aliases CVE-2025-34153GHSA-4vjp-phjj-3f57

Hyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE

Priority HIGH 82CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in Hyland.Core.Timers.dll. This endpoint deserializes untrusted input using the .NET BinaryFormatter, allowing attackers to execute arbitrary code under the context of NT AUTHORITY\SYSTEM.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed OnBase (Hyland Software): 17.0.2.87, 24.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HylandOnBasebefore 17.0.2.8717.0.2.87, 24.1Patch availableCNA
  • OnBase VendorHyland Affected before 17.0.2.87 Fixed in 17.0.2.87, 24.1 Patch available CNA

Remediation

  • Fix · CNA OnBase (Hyland Software) Fixed in 17.0.2.87, 24.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34153
  2. 2026-10-03 Alias added: GHSA-4vjp-phjj-3f57
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-41859 PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service CVSS 4.0CRITICAL 9.3
  • TI-2026-41858 PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service CVSS 4.0CRITICAL 9.3
  • TI-2023-27323 An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. CVSS 3.1HIGH 8.8
  • TI-2024-26898 A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform… CVSS 3.1MEDIUM 6.1
  • TI-2021-12493 Regular expression Denial of Service in MooTools CVSS 3.1MEDIUM 6.1
  • TI-2026-21212 Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE CVSS 4.0CRITICAL 9.3
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences