RBH Access Integra32 Security Management System 5.1.11 R5.0 .NET Remoting Service AxcvcLt.dll deserialization

Summaryinfo

A vulnerability, which was classified as very critical, has been found in RBH Access Integra32 Security Management System 5.1.11 R5.0. Impacted is an unknown function of the file AxcvcLt.dll of the component .NET Remoting Service. The manipulation leads to deserialization. This vulnerability is listed as CVE-2026-63079. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in RBH Access Integra32 Security Management System 5.1.11 R5.0. This issue affects an unknown functionality of the file AxcvcLt.dll of the component .NET Remoting Service. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.

It is possible to read the advisory at gist.github.com. The identification of this vulnerability is CVE-2026-63079 since 07/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/13/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• RBH Access

Name

• Integra32 Security Management System

Version

• 5.1.11 R5.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion