CVE-2025-34153 is a critical unauthenticated remote code execution vulnerability in Hyland OnBase prior to version 17.0.2.87. The issue arises from insecure deserialization of untrusted input on the .NET Remoting TCP channel, specifically at the TimerServer URI endpoint on port 6031, implemented in Hyland.Core.Timers.dll. The endpoint uses the .NET BinaryFormatter, which is vulnerable to deserialization attacks, allowing attackers to execute arbitrary code as NT AUTHORITY\SYSTEM. This vulnerability has a CVSS 4.0 score of 10.0, reflecting its high impact and ease of exploitation. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation results in unauthenticated remote code execution with SYSTEM-level privileges on affected Hyland OnBase installations. This allows attackers full control over the compromised system, posing a critical security risk. There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to port 6031 and monitor for suspicious activity targeting the TimerServer endpoint. Avoid exposing the vulnerable service to untrusted networks.