Hyland OnBase allows an unauthenticated attacker to send crafted .NET Remoting requests to the Workflow Timer Service (Hyland.Core.Workflow.NTService.exe) over TCP/8900. The server performs unsafe object unmarshalling, giving the attacker the power to read or write arbitrary files and, by inserting content into web‑accessible locations or chaining with other OnBase features, to execute code remotely. The same mechanism can be used to supply a UNC path that coerces the server into performing outbound NTLM authentication to an attacker‑controlled SMB host, potentially enabling further compromise. This vulnerability is classified under CWE‑502.

Hyland OnBase Workflow Timer Service, named Hyland:OnBase Workflow Timer Service. No specific product versions were listed in the advisory.

The CVSS base score of 9.3 marks this as high severity. The EPSS score is below 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑directed exploitation of the exposed .NET Remoting endpoint on port 8900, requiring only that the attacker can reach the service. Successful exploitation grants read/write access to critical files and can lead to remote code execution. The risk therefore remains significant for any exposed instance of the Timer Service, even if exploitation is currently rare.