U-Office Force, a product by e-Excellence, contains an insecure deserialization flaw that permits unauthenticated attackers to send specially crafted serialized data to the server. This exploitation can lead to arbitrary code execution, giving attackers full control of the affected machine, effectively compromising confidentiality, integrity, and availability of the system. The weakness is classified as CWE‑502, reflecting the unsafe handling of serialized objects.

The vulnerability affects the e‑Excellence U‑Office Force application across all versions prior to 29.50SP1. Vendors and customers using any earlier release are susceptible, while upgrading to version 29.50SP1 or later removes the flaw.

The CVSS score of 9.3 marks it as Critical, yet the current EPSS value of less than 1% indicates a low probability of active exploitation at the present moment. It is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker transmitting malicious serialized content to a publicly exposed endpoint that processes such data without proper validation. Successful exploitation would allow the attacker to run arbitrary code with the service’s privileges.