CVE-2026-63079: Critical severity RBH Access Technologies Integra32 Security Management System vulnerability
RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to remote exploitation?
Integra32 Security Management System 5.1.11 R5.0 systems with the deprecated .NET Remoting service exposed on TCP port 2001 are remotely reachable by an unauthenticated attacker. No credentials or user interaction are required.
What level of access can exploitation provide?
A successful malicious serialized payload can result in remote code execution as NT AUTHORITY\SYSTEM, enabling full compromise of the affected host. The unmarshalling behavior may also permit arbitrary file read/write and SMB/NTLMv2 credential coercion.
How can I identify the affected service on a host?
Check whether the Integra32 deprecated .NET Remoting service is listening on TCP port 2001 and uses the AxcvcLt.dll library with BinaryServerFormatterSinkProvider configured at TypeFilterLevel.Full. The described target endpoint is the IntegraURI object endpoint.