CVE-2026-25550 affects Seagull Software BarTender 2010, 2016, and 2019 through an unauthenticated remote code execution vulnerability in the .NET Remoting service (BtSystem.Service.exe) listening on TCP port 7375. The service registers an unauthenticated singleton endpoint (BarTenderSystem for 2016 <= R9, DataServiceSingleton for 2019 <= R10) configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full, enabling unsafe deserialization. An attacker can exploit this to perform arbitrary file read/write operations or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server. The service runs under NT AUTHORITY\SYSTEM, which can lead to credential disclosure, remote code execution, or lateral movement depending on environment and privileges.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges, read or write arbitrary files on the server, and potentially disclose sensitive credentials via coerced NTLMv2 authentication. This can lead to full system compromise and lateral movement within the network. The CVSS 4.0 score is 9.3 (critical), reflecting the high impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to TCP port 7375 to trusted hosts only and consider disabling the .NET Remoting service if not required. Monitor for unusual activity related to BarTender services. Do not rely on generic mitigations; follow vendor instructions once published.