CVE-2026-23746 is a critical vulnerability in Entrust Instant Financial Issuance (IFI) On Premise software versions 5.x prior to 6.10.5 and 6.11.1. The SmartCardController service (DCG.SmartCardControllerService.exe) registers a TCP remoting channel with unsafe formatter settings that permit untrusted remote object invocation. An unauthenticated remote attacker with network access to the remoting port can exploit this to read arbitrary files, coerce outbound authentication, and potentially write files or execute code remotely using known .NET Remoting exploitation techniques. This vulnerability stems from missing authentication controls on critical functions (CWE-306) and unsafe deserialization (CWE-502).

Successful exploitation allows remote unauthenticated attackers to read sensitive files on the server, coerce authentication mechanisms, and potentially execute arbitrary code remotely. This can lead to full compromise of the affected host, including disclosure of sensitive installation and service-account credentials, severely impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a patch is available, restrict network access to the SmartCardController remoting port to trusted administrators only to reduce exposure.