CVE-2026-105667
7.5HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-306
Impact
Remote attackers can reassign studies and workflow records between patient identities with no authentication, causing irreversible record corruption. They only need network access to the HL7 listener service.
Root cause
The HL7 listener accepts ADT^A40 patient-merge messages by default without authenticating the sending application.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Check the CISA advisory (icsma-26-288-02) for the official patch version; as an immediate mitigation, restrict network access to the HL7 listener port using firewall rules or ACLs to trusted sender IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.