CVE-2026-25550: Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

Synopsis

An unauthenticated remote code execution vulnerability exists in Seagull Software BarTender versions 2010, 2016, and 2019, caused by an insecure .NET Remoting service exposed on TCP port 7375. Any attacker who can reach this port over the network can exploit unsafe object deserialization without providing any credentials. Successful exploitation gives the attacker arbitrary file read and write on the host, NTLMv2 credential capture, and full remote code execution running as NT AUTHORITY\SYSTEM. No vendor-supplied fix is available; HarborGuard tracks this advisory and will surface patch availability as soon as upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach TCP port 7375 on the host running BtSystem.Service.exe over the network; any internet- or intranet-exposed deployment is at risk.

• AuthenticationNot required

  The .NET Remoting endpoint registers an unauthenticated singleton, so no account credentials of any privilege level are needed to send malicious payloads.

• Victim interactionNot required

  Exploitation is fully server-side; no user action, click, or session is required from anyone on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory layout knowledge, or environmental setup beyond network access to the exposed port.

Blast Radius

• Reads arbitrary files on the server filesystem, including configuration files, secrets, and private keys accessible to NT AUTHORITY\SYSTEM.
• Writes arbitrary files to the server filesystem, enabling web shell placement, binary replacement, or persistence mechanisms.
• Captures NTLMv2 credential hashes from the service account (NT AUTHORITY\SYSTEM) by coercing authentication to an attacker-controlled UNC path, usable for relay attacks or offline cracking.
• Executes arbitrary code as NT AUTHORITY\SYSTEM, granting full control of the host and enabling lateral movement to other systems reachable from the server.