External risk intelligence

Integra32 Unauthenticated .NET Remoting Deserialization RCE.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-63079

The vulnerability affects a security management system's .NET Remoting service on TCP port 2001. While this port is network-reachable and the service is unauthenticated, such management services are typically intended for internal administrative use within a local area network or behind a VPN rather than being exposed directly to the public internet by design.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in RBH Access Technologies' Integra32 security management system. A flaw in its deprecated .NET Remoting service allows unauthenticated remote attackers to execute arbitrary code on the host system, potentially leading to a full compromise. The main concern is confirming relevance and exposure due to the specific nature of the affected service.

Unauthenticated attackers can gain full system control.
This impacts critical security management systems.
Confirm if your system is exposed and relevant.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted data over the network to a vulnerable service accessible on TCP port 2001. This data, processed by a deprecated .NET Remoting feature, can lead to arbitrary code execution with high privileges on the affected system.

Network access required.
Malicious serialized data triggers vulnerability.
Remote code execution as SYSTEM.

Live Threat

Current exploitation, exposure, and threat context

A critical unauthenticated deserialization vulnerability in the deprecated .NET Remoting service of the Integra32 Security Management System could allow a remote attacker to execute arbitrary code as the SYSTEM user. This could occur when the vulnerable service is exposed on TCP port 2001 and receives a malicious serialized payload.

Sensitive system data.
Malicious serialized payload sent remotely.
Full host compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation for this critical vulnerability in RBH Access Technologies Integra32 falls to the teams managing the security infrastructure and the application itself. The first practical step involves identifying all instances of the affected Integra32 system, confirming its network exposure, and determining its business criticality. This will help prioritize which systems require immediate attention and ensure the correct owners are engaged for planning remediation, which may involve vendor coordination.

Security and infrastructure teams own remediation.
Verify Integra32 instances and network exposure.
Plan vendor engagement and risk-based patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Integra32 Security Management System?

Integra32 by RBH Access Technologies is a software platform designed to manage physical security, such as access control and building security hardware. It integrates various security components into a central management interface. The vulnerability specifically affects the software's use of a legacy .NET Remoting service, which was historically used for communication between parts of the application.

What does deserialization mean in CVE-2026-63079?

This vulnerability is classified as CWE-502, or deserialization of untrusted data. When the software receives data from the network, it must turn that data back into usable objects. If the process does not properly check the incoming data, an attacker can supply a malicious object that tricks the system into executing unauthorized commands. In this case, the flaw allows the attacker to execute code as the highly privileged NT AUTHORITY\SYSTEM user.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted, serialized data payload to the vulnerable .NET Remoting service, which listens on TCP port 2001. No authentication or user interaction is required to initiate this process. The vulnerability does not trigger if the service is disabled or if the host is completely blocked from receiving incoming traffic on that specific TCP port.

How do I know if my system is at risk?

According to Halo Surface Signal, this software is often used internally within a local network or VPN. While the vulnerability is critical, you should prioritize checking any Integra32 instances that are reachable from the public internet, as these present a significantly higher risk. Identifying whether your deployment exposes port 2001 to broader network segments is a key step in assessing your immediate threat level.

What should I do first to secure my systems?

Start by identifying all deployed instances of the Integra32 system within your environment. Once identified, verify if the service is currently accepting connections on TCP port 2001. If found, work with your infrastructure and security teams to restrict network access to this port immediately, keeping it off the public internet, and contact RBH Access Technologies to coordinate remediation or updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.