CERT/CC Discloses Two Critical Vulnerabilities in INFINITT PACS Healthcare Imaging Software
CERT/CC published a security advisory on November 2, 2026, disclosing two vulnerabilities in INFINITT PACS, a web-based radiology imaging platform used by more than 6,500 healthcare sites in 55 countries. The flaws, CVE-2026-16305 and CVE-2026-16306, affect INFINITT Healthcare System Manager versions 3.0.11.3 and 3.0.11.5, and could allow local privilege escalation to administrative rights or remote code execution via a malicious URI link. No active exploitation or public exploit code has been reported, but the risk to patient imaging data and hospital networks is significant given the software's widespread clinical use.
Entenda a falha
A vulnerabilidade
Two flaws in INFINITT Healthcare System Manager 3.0.11.3 and 3.0.11.5, part of the INFINITT PACS radiology imaging platform. CVE-2026-16306 is a remote code execution in IModular.exe: it needs a healthcare worker to click a malicious imodular:// link, and the attacker gets code execution (programs from local folders or network shares). CVE-2026-16305 is a local privilege escalation in the update manager: a local attacker who can edit a weakly protected manifest gets commands run with administrative rights once an update is approved at the UAC prompt. The vendor fixed both in versions 3.0.12.3 and 3.0.12.5. The advisory's severity is still listed as awaiting analysis.
Como funciona
In the update flow, SmartUpdate.exe launches SmartExecute.exe, which reads a manifest file, execlist.txt, and runs the commands listed in it. Because the file has weak permissions, a local user can change it before it is read. When the user approves the UAC prompt, the listed commands run with administrative rights. In the second flaw, the imodular:// URI scheme is registered on the workstation, so clicking such a link hands the command to IModular.exe. The program dispatches the command without checking whether it is safe, so it can launch programs from local folders or network shares, or make an outbound call to an external SignalR server set through a URL parameter.
Por que é vulnerável
CVE-2026-16305 comes from an improperly protected update manifest: execlist.txt has weak file permissions, yet SmartExecute.exe trusts its contents and runs them elevated. CVE-2026-16306 comes from unsafe command dispatch: IModular.exe does not validate whether commands received through the imodular:// scheme are safe before running them. The articles do not describe why these went unnoticed or the details of the code changes in the fixed versions.
Onde está
SmartExecute.exe and its manifest execlist.txt (run via SmartUpdate.exe) for CVE-2026-16305, and IModular.exe with its imodular:// URI handler for CVE-2026-16306.
Como foi descoberta
The articles do not say who found the flaws or how. CERT/CC published an advisory on November 2, 2026. It states there are no indications the vulnerabilities have been exploited, and the vendor reports no attacks in customer networks.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:10.
Detalhes técnicos
CVE-2026-16305 is a local privilege escalation flaw in the update manager: SmartExecute.exe reads and executes commands from a weakly-permissioned manifest file (execlist.txt) during updates performed by SmartUpdate.exe. A local attacker can modify the manifest before it runs, and once a User Account Control prompt is approved, the rogue commands execute with administrative privileges. CVE-2026-16306 is a remote code execution issue in IModular.exe, which unsafely dispatches commands registered under the custom imodular:// URI scheme without validating command safety. An attacker could lure a healthcare worker into clicking a malicious link, causing execution of programs from local folders or network shares, or triggering an outbound call to an external SignalR server via a URL parameter.
Remediação
INFINITT Healthcare has released patched versions 3.0.12.3 and 3.0.12.5 of System Manager. Administrators should apply these updates immediately, restrict permissions on workstation update folders, and block untrusted outbound web traffic to reduce exposure.
Linha do tempo
-
CERT/CC Discloses Two Critical Vulnerabilities in INFINITT PACS Healthcare Imaging Software
ler a análise desta fonte ocultar
CERT/CC published a security advisory on November 2, 2026, disclosing two vulnerabilities in INFINITT PACS, a web-based radiology imaging platform used by more than 6,500 healthcare sites in 55 countries. The flaws, CVE-2026-16305 and CVE-2026-16306, affect INFINITT Healthcare System Manager versions 3.0.11.3 and 3.0.11.5, and could allow local privilege escalation to administrative rights or remote code execution via a malicious URI link. No active exploitation or public exploit code has been reported, but the risk to patient imaging data and hospital networks is significant given the software's widespread clinical use.
Technical Details
CVE-2026-16305 is a local privilege escalation flaw in the update manager: SmartExecute.exe reads and executes commands from a weakly-permissioned manifest file (execlist.txt) during updates performed by SmartUpdate.exe. A local attacker can modify the manifest before it runs, and once a User Account Control prompt is approved, the rogue commands execute with administrative privileges. CVE-2026-16306 is a remote code execution issue in IModular.exe, which unsafely dispatches commands registered under the custom imodular:// URI scheme without validating command safety. An attacker could lure a healthcare worker into clicking a malicious link, causing execution of programs from local folders or network shares, or triggering an outbound call to an external SignalR server via a URL parameter.
Remediation
INFINITT Healthcare has released patched versions 3.0.12.3 and 3.0.12.5 of System Manager. Administrators should apply these updates immediately, restrict permissions on workstation update folders, and block untrusted outbound web traffic to reduce exposure.