A deserialization flaw in GFI Archiver’s MArc.Core.Remoting.exe allows an attacker to execute arbitrary code in the context of SYSTEM. The vulnerability arises because the software fails to validate data supplied to the deserialization routine for that component. Exploiting it enables remote execution of attacker‑controlled code, potentially compromising the entire host. The weakness is classified as CWE‑502, Deserialization of Untrusted Data.

The flaw affects GFI Archiver version 15.10, which runs the MArc.Core.Remoting.exe process listening on port 8017. Only installations of the specified vendor product version are known to be susceptible, and no other versions are listed in the available data.

The severity score of 8.8 indicates a high‑impact attack, and the exploitation probability, as reflected by an EPSS score of less than 1 percent, suggests that real‑world exploitation is currently low. The vulnerability requires authentication, but the input mentions that the existing authentication can be bypassed, implying that an attacker could succeed even without valid credentials. Because the remote endpoint is exposed on port 8017, the attack vector is likely network‑based. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no documented active exploits are known at this time. Nevertheless, the combination of high impact and potential authentication bypass warrants urgent attention.