Do Son 
TL;DR
CERT/CC released a security notice on November 2, 2026. The alert warns of two serious INFINITT PACS vulnerabilities in hospital imaging systems. These flaws let attackers execute code. They also let attackers gain full admin rights. Therefore, medical teams must install the latest patches right away. They need to protect their hospital networks from harm.
- Product: INFINITT Healthcare System Manager
- Vulnerabilities: 2 flaws (CVE-2026-16305, CVE-2026-16306)
- Highest severity: Awaiting analysis
- Worst impact: CVE-2026-16305
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | Type | Status |
|---|---|---|
| CVE-2026-16305 | CVE-2026-16305 | Not exploited |
| CVE-2026-16306 | CVE-2026-16306 | Not exploited |
Why It Matters
INFINITT PACS is a web tool. Staff use it to store and view patient radiology scans. According to company data, more than 6,500 healthcare sites in 55 countries use INFINITT software. Hospitals rely on these tools for daily clinical care. Because of this, software flaws put patient health files at risk. Bad actors could tamper with private medical scans.
Fortunately, the vendor reports no active attacks in customer networks. The advisory confirms: “There are no indications that these vulnerabilities have been exploited.” In addition, researchers have shared no public exploit code for either issue.
How the Attack Works
The security notice details two distinct attack paths in update tasks and custom links.
Update Manifest Privilege Escalation
First, CVE-2026-16305 is a local privilege escalation bug in the update manager. The official CERT/CC advisory explains the risk. It warns that “An improperly protected update manifest may allow a local attacker to execute commands with administrative privileges when an update is approved.”
Specifically, SmartExecute.exe reads and runs commands from a file named execlist.txt during software updates. Due to weak file permissions on this manifest, a local user can edit the file before it runs. When SmartUpdate.exe runs the tool, User Account Control prompts the user. If approved, the app runs the rogue commands with admin rights.
Custom URI Code Execution
Second, CVE-2026-16306 involves remote code execution in IModular.exe. The report explains: “An unsafe command dispatch through the registered imodular:// URI scheme may result in code execution.” The program runs the custom link without checking if the command is safe.
An attacker can trick a health worker into clicking a bad link. Consequently, IModular.exe runs programs from local folders or network shares. The link also takes a URL parameter. This parameter forces an outbound call to an external SignalR server.
Affected Versions
These INFINITT PACS vulnerabilities affect systems on System Manager versions 3.0.11.3 and 3.0.11.5.
Patch and Mitigation Steps
INFINITT Healthcare released security patches to fix both flaws. Admins should update System Manager to version 3.0.12.3 or 3.0.12.5 right away. Furthermore, IT teams should lock down workstation update folders. They should also block untrusted outbound web traffic.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
