Unisys WebPerfect Image Suite 3.0.3960.22810 and 3.0.3960.22604 allow a remote attacker to exploit a deprecated .NET Remoting TCP channel. By supplying a Windows UNC path as a target file argument, the service performs object-unmarshalling that leaks NTLMv2 machine‑account hashes. The attacker can capture the hash and use it for relay attacks, enabling privilege escalation or lateral movement on the network. The root weakness is an insecure legacy .NET Remoting implementation that causes sensitive credential exposure.

The vulnerability affects Unisys WebPerfect Image Suite version 3.0.3960.22810 and 3.0.3960.22604. No other versions are listed in the CNA data, so administrators should verify the exact build they run against these identifiers.

The CVSS score is 7.0, indicating a high impact vulnerability. The exploit probability is not available, but the lack of EPSS data suggests the attack is not widely automated yet. The vulnerability is not in the CISA KEV catalog, reducing the immediacy of known exploitation. Attackers need remote network access to the .NET Remoting endpoint, are unauthenticated, and must craft a UNC path payload, which suggests that lateral movement detection and proper network segmentation can mitigate risk.