---
id: "CVE-2026-63079"
page: "https://infrastack.ai/live/CVE-2026-63079"
kind: "vulnerability"
aliases: ["CVE-2026-63079"]
title: "RBH Integra32: unauthenticated .NET Remoting flaw gives remote SYSTEM code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Integra32 Security Management System", "fixed": [], "affected": "<= 5.1.11 R5.0", "ecosystem": "vendor"}]
ecosystems: []
tags: [".net-remoting", "industrial-control", "infrastructure", "integra32", "rbh-access-technologies", "self-hosted", "windows"]
not_affected_if: ["other-versions", "port-2001-blocked"]
published_at: "2026-11-13T16:19:30+00:00"
first_seen_at: "2026-11-13T16:47:35+00:00"
updated_at: "2026-11-13T16:49:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63079", "first_seen_at": "2026-11-13T16:47:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T16:49:03+00:00"}]
exploit_sources: []
---

# RBH Integra32: unauthenticated .NET Remoting flaw gives remote SYSTEM code execution

Link for people: https://infrastack.ai/live/CVE-2026-63079 (this .md is for agents)

Integra32 Security Management System 5.1.11 R5.0 exposes a deprecated .NET Remoting service on TCP port 2001 that deserializes untrusted data without authentication. A remote attacker can send a crafted payload to run code as NT AUTHORITY\SYSTEM, or read and write files and capture SMB/NTLMv2 credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Integra32 Security Management System affected <= 5.1.11 R5.0 fixed no fixed version listed

## How to check

Check whether the Integra32 server listens on TCP 2001 (netstat -ano | findstr :2001) and whether AxcvcLt.dll is in the install directory. Affected per VulnCheck: Integra32 <= 5.1.11 R5.0. Whether port 2001 is on by default is not stated by the sources. Also check from another host whether 2001 is reachable.

## Fix

No vendor advisory or fixed version found. RBH lists 5.1.16 as its current R5 release, but no source ties it to this CVE. Ask RBH. Until then, block TCP 2001 at the firewall except from trusted Integra32 clients and keep the server off the internet.

## Timeline

- 2026-11-13T16:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63079
- 2026-11-13T16:49:03+00:00 analyst — Read VulnCheck advisory (third-party, not vendor). No RBH advisory or fix found; RBH support page lists Integra32 R5 v5.1.16 as current release but states nothing about this CVE, so fix unknown. Port 2001 default-enabled not stated by any source. Nothing verified.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/rbh-integra32-net-remoting-deserialization-rce

## From the sources

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_