CVE-2026-25856 is an authenticated remote code execution vulnerability in OpenBullet2 up to version 0.3.2. Authenticated users can execute arbitrary C# code on the server by manipulating job configurations. The vulnerability arises because the plain C# execution mode does not filter references or restrict API calls, enabling full access to the file system, process creation, and arbitrary .NET API invocation under the process user context. This flaw allows attackers to perform actions equivalent to remote code execution with the privileges of the OpenBullet2 process.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server hosting OpenBullet2, potentially leading to full system compromise depending on the privileges of the OpenBullet2 process. The attacker can access files, spawn processes, and invoke any .NET API, which can result in data theft, service disruption, or further lateral movement within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to OpenBullet2 to trusted users only and monitor for suspicious activity related to job configuration changes. Consider isolating the OpenBullet2 server and limiting its privileges to reduce potential impact.