Hyland OnBase Workflow Timer Service 8.0 has an unauthenticated .NET Remoting vulnerability (CWE-502) that allows unsafe deserialization of untrusted data via default HTTP channel endpoints on TCP/8900. This flaw permits attackers to perform arbitrary file read/write operations and potentially achieve remote code execution by placing malicious content in web-accessible locations or chaining with other OnBase features. Additionally, the vulnerability can be exploited to coerce outbound NTLM authentication through SMB by specifying UNC paths. The vulnerability is remotely exploitable without authentication or user interaction, resulting in a critical security risk.

Successful exploitation allows an unauthenticated attacker to read and write arbitrary files on the affected system, potentially leading to remote code execution. The vulnerability also facilitates SMB coercion attacks, which can be used for credential theft or lateral movement. This poses a significant risk to confidentiality, integrity, and availability of the affected system and network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the OnBase Workflow Timer Service on TCP port 8900 to trusted hosts only to prevent unauthenticated remote exploitation. Monitor vendor communications closely for updates and apply patches promptly once released.