This vulnerability (CVE-2025-15610) in OpenText RightFax allows an attacker to perform deserialization of untrusted data, resulting in object injection. It affects multiple versions of RightFax (16.6 through 25.4) on Windows platforms. The vulnerability is classified under CWE-502. The CVSS 4.0 vector indicates that the attack can be performed remotely without authentication or user interaction, with high impact on system confidentiality, integrity, and availability. No patch or official remediation level has been published by OpenText as of the data provided.

Successful exploitation could allow an unauthenticated remote attacker to inject malicious objects via deserialization, potentially leading to full compromise of the affected RightFax system, including unauthorized access, data manipulation, or service disruption. The critical CVSS score reflects the high risk posed by this vulnerability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by OpenText, organizations should monitor vendor communications closely. Until a patch is available, consider restricting network access to the RightFax service to trusted sources only and apply any available application-level controls to limit exposure to untrusted input.