Critical .NET Deserialization Vulnerability in ibaPDA and ibaDatCoordinator

certvde.com

Critical .NET Deserialization Vulnerability in ibaPDA and ibaDatCoordinator

First seen 17 Jun 2026, 16:41 UTC • •72.6

Article Content

1 / 4

Browse articles

ThreatCluster •June 18, 2026 at 16:04 UTC

•Unauthenticated remote code execution vulnerability in ibaPDA and ibaDatCoordinator.
•Affected applications can be exploited via .NET deserialization flaws.
•Users must upgrade to specified versions to mitigate the risk.

A vulnerability has been discovered in ibaPDA and ibaDatCoordinator that allows unauthenticated remote attackers to execute arbitrary code via .NET deserialization. This flaw affects the applications due to improper restrictions on the .NET BinaryFormatter during client-server communication. The vulnerability enables privilege escalation under the service user account, potentially granting full system access. The affected applications are ibaPDA and ibaDatCoordinator, which utilize TCP port 9170 for server communication. Users are advised to upgrade to ibaPDA version 8.14.0 and ibaDatCoordinator version 4.0.7 to mitigate the risk. The vulnerability is similar to previously documented issues with .NET BinaryFormatter. Security experts recommend restricting connections to localhost and adjusting firewall settings to enhance security. Immediate action is necessary to prevent exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 114d ago How this analysis works

Timeline

2026-06-17

Vulnerability disclosed

A .NET deserialization vulnerability was publicly disclosed affecting ibaPDA and ibaDatCoordinator.

2026-06-17

Patch released

Users are urged to upgrade to ibaPDA v8.14.0 and ibaDatCoordinator v4.0.7 to address the vulnerability.

More articles in this cluster (3)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Remote Code Execution
Zero-day Exploit
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Weakness (1)

CWE-502 - Deserialization Of Untrusted Data

Relationships

Remote Code Execution related to Zero-day Exploit
Remote Code Execution related to CWE-502 - Deserialization Of Untrusted Data
Remote Code Execution related to T1190 - Exploit Public-Facing Application
Remote Code Execution related to T1203 - Exploitation for Client Execution

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…