CVE-2026-11857: Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation

Synopsis

This is an insecure deserialization vulnerability in the Client Update Service component of Quanos SCHEMA ST4 on-premises software. The flaw is exploitable only from the local host by an authenticated user who connects to a named pipe and sends a crafted serialized object to the .NET Remoting endpoint, which is configured with TypeFilterLevel.Full. Successful exploitation gives the attacker arbitrary code execution as NT AUTHORITY\SYSTEM, representing a full local privilege escalation. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; the vulnerable named pipe is bound to local interfaces only and cannot be reached over the network.

• AuthenticationRequired

  A low-privilege local user account is sufficient; the attacker must hold an authenticated session on the host to connect to the named pipe.

• Victim interactionNot required

  No action from another user or process is needed; the attacker connects and sends the payload entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required to deliver the crafted serialized object.

Blast Radius

• Attacker executes arbitrary code in the context of the Client Update Service process running as NT AUTHORITY\SYSTEM, gaining full control of the operating system on the affected host.
• All files, registry keys, and secrets accessible to SYSTEM can be read, including credentials cached on the host.
• The attacker can write or overwrite any file on the host, install drivers, create new accounts, or tamper with any running process.