This vulnerability (CVE-2025-15610) affects OpenText RightFax versions 16.6 through 25.4 and stems from the use of the .NET Remoting framework, which is susceptible to deserialization of untrusted data (CWE-502). Such deserialization flaws can allow attackers to execute arbitrary code or cause denial of service if they can send crafted data to the remoting service. The vulnerability requires that the remoting ports be accessible over the network, as the attack vector is network-based with no privileges or user interaction needed. The CVSS 4.0 score of 9.3 reflects critical impact on confidentiality, integrity, and availability. Currently, no official patch or remediation level has been published by OpenText, and no exploits are known in the wild.

Successful exploitation could lead to remote code execution or denial of service on affected RightFax servers, compromising confidentiality, integrity, and availability of the system. Because the vulnerability requires network access to remoting ports, exposure of these ports increases risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, organizations should ensure that remoting ports are not exposed to untrusted networks. Restrict network access to the RightFax remoting service to trusted hosts only and monitor for unusual activity related to these ports. Follow OpenText advisories closely for updates on remediation.