CVE-2026-25550 Seagull Software, LLC. CVE debrief

Who should care

Defenders responsible for BarTender installations, especially those exposed to untrusted networks, should assess exposure and prioritize remediation. System administrators and security teams should verify affected versions and plan for upgrades to BarTender 12.0.1 or later.

Why it matters

CVE-2026-25550 is a critical vulnerability in Seagull Software BarTender that allows unauthenticated remote code execution. Defenders should prioritize remediation, especially for installations exposed to untrusted networks. The vulnerability's impact includes potential for lateral movement, sensitive credential disclosure, and arbitrary file access.

• Unauthenticated remote code execution
• Arbitrary file read/write capabilities
• Potential for lateral movement via NTLMv2 authentication coercion
• Sensitive credential disclosure

Technical summary

The .NET Remoting service in Seagull Software BarTender 2010, 2016, and 2019 exposes an unauthenticated singleton endpoint configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. This allows an unauthenticated remote attacker to exploit .NET Remoting object unmarshalling to read or write arbitrary files on the server, or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server.

Defensive priority

High priority remediation is recommended for BarTender installations, especially those exposed to untrusted networks.

Recommended defensive actions

• Immediately upgrade BarTender to version 12.0.1 or later
• Restrict access to TCP port 7375 to trusted networks only
• Monitor for suspicious activity on affected systems
• Verify service account privileges and network environment for potential lateral movement
• Perform an inventory of affected BarTender installations
• Establish a rollback plan for emergency changes if needed
• Track remediation progress and verify fixes

Evidence notes

The vulnerability is confirmed in BarTender 2010, 2016, and 2019 versions. The .NET Remoting service is exposed on TCP port 7375 and allows unauthenticated access. The service runs in the context of NT AUTHORITYSYSTEM, increasing the potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.