CVE-2026-25550
BarTender 2010, 2016, and 2019 contain a critical flaw that lets anyone on the network run code on the machine. The vulnerability is in a .NET Remoting service that listens on TCP port 7375 and runs as SYSTEM. An attacker can read or write files, steal credentials, or move laterally.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Seagull Software BarTender 2010, 2016, and 2019 (all releases up to 2019 R10). Typical users are organizations that run BarTender on Windows servers.
Real-world impact
An unauthenticated attacker can execute arbitrary code, read or write files, steal credentials, and potentially move laterally across the network.
Why this severity
The CVSS score of 9.3 reflects the lack of authentication, the high impact on confidentiality, integrity, and availability, and the ability to run code with SYSTEM privileges.
What to do about it
- ›Block TCP port 7375 to prevent remote access to the vulnerable service.
- ›Disable or remove the BtSystem.Service.exe if it is not required for business operations.
- ›Apply any vendor updates or patches when they become available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD-referenced vendor advisory (no fix documented).
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.