I nearly made a post about this today but thought it was just an issue for our environment, but upon further investigation have found that it happened on both Production (SharePoint 2016 running Nintex Forms for SharePoint 2016 - International version: 4.6.3.0) and in our Test (SharePoint 2019 running Nintex Forms for SharePoint 2019 - International version: 5.2.8.0), making me think that a microsoft update is the cause.

After doing some digging the real-time logs I discovered that the error (for us) was originating from the Update Item workflow action. Any workflow with that action would fail to publish (though I could save them). Here is a full transcript of the error in question: 

# Starting around 9/16/2024 @ 19:16:18.67 SharePoint Foundataion ran into an error
# Product: SharePoint Foundataion
# Category: Legacy Workflow Infrascructure
# Process: w3wp.exe (0x106C)
# Decimal: 4204
# Thread (Hex): 0x1EE0
# Decimal: 7904
# EventID: c42q0
# Level: High
# Correlation: 31f850a1-1881-70da-f9e2-ba10dcafcc5c

# Custom Column Information: (POST:http://WEB/SITES/MAIN_SITE/SUB_SITE_1/SUB-SITE_2/_layouts/15/NintexWorkflow/_vti_bin/NintexWorkflow/Workflow.asmx:PublishWorkflow2)
# Site: /sites/MAIN_SITE

# MESSAGE: 
#   Potentially malicious xoml node: 
#     <ns2:UpdateItemActivity 
#       ItemProperties="{ActivityBind ROOT,Path=_Hashtable55}" 
#       __Context="{ActivityBind ROOT,Path=__context}" 
#       ListId="{ActivityBind ROOT,Path=__list}" 
#       Description="
#         <ActivityFlags>
#           <TLabel>Update item</TLabel>
#           <LLabel />
#           <RLabel />
#           <Hidden>false</Hidden>
#           <Sequence>11</Sequence>
#           <BLabel>SET: EDesign Submittal Number]  = var_DesignSubmittalNumber</BLabel>
#           <CustomComments />
#           <ShowCustomComments>false</ShowCustomComments>
#           <CommentType>Auto</CommentType>
#           <HideFromUI>false</HideFromUI>
#           <Enabled>true</Enabled>
#           <ExpectedDuration>-1</ExpectedDuration>
#           <UserContext>Default</UserContext>
#         </ActivityFlags>"
#       ListItem="{ActivityBind ROOT,Path=__item}" 
#       x:Name="updateItemActivity1" 
#       xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" 
#       xmlns:ns2="clr-namespace:Microsoft.SharePoint.WorkflowActions.WithKey;Assembly=Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

The only way I have found to fix it was to run these powershell commands on the web server of the servers in question: 

Add-PSSnapin Microsoft.SharePoint.PowerShell
$farm=Get-SPFarm
$farm.EnablePreParseSecurityCheckForWorkflow = $false
$farm.update()

iisreset

After the iisreset, I was able to once again publish my workflows. 

let me know if that helps 

UPDATE: It seems that from the time I found how to fix this on my own from a random German blog, it has been confirmed that it is indeed due to a Microsoft Update. More discussion and possible solutions can be found here (though you will need to scroll around a bit to find the info regarding nintex): https://blog.stefan-gossner.com/2024/09/13/trending-issue-problems-with-workflows-after-applying-september-2024-cu-for-sharepoint-2016-2019-se/

There is also a MS KB Article posted about it featuring the power shell script I posted from before this update: https://support.microsoft.com/en-us/topic/some-scenarios-of-sharepoint-2010-workflow-are-affected-after-applying-the-july-security-update-for-sharepoint-server-kb5004862-be361cd6-9f54-48c4-b890-2c4b7cf49d13

I’m not sure if Nintex has released official instructions regarding this, but I hope they can soon. 

HI,

I googled this error and it looks like it is related to an issue Nintex discovered 3 years ago.
 

Hi @VenkatesanMonika 
Did these responses help solve your question?