Hyland OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe) version 8.0 exposes unauthenticated .NET Remoting endpoints on TCP port 8900. These endpoints (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem) accept serialized objects without proper validation, resulting in unsafe deserialization (CWE-502). An attacker can exploit this to perform arbitrary file read/write operations. By placing attacker-controlled files in locations accessible via web or chaining with other OnBase components, remote code execution is possible. The vulnerability also enables SMB coercion attacks by supplying UNC paths, forcing the service to authenticate to attacker-controlled SMB servers.

Successful exploitation allows unauthenticated remote attackers to read and write arbitrary files on the affected system, potentially leading to remote code execution. The vulnerability also facilitates SMB coercion attacks, which can be used to capture NTLM authentication hashes. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, organizations should restrict network access to the OnBase Workflow Timer Service on TCP port 8900 to trusted hosts only and monitor for unusual network activity targeting this port. Avoid exposing the service to untrusted networks until a fix is available.