Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes. This occurs when attackers supply a Windows UNC path as a target file argument through object-unmarshalling techniques. The leaked NTLMv2 hashes can be captured and relayed to other hosts, potentially enabling privilege escalation or lateral movement depending on network configuration and patch status.