CVE-2026-2362 – OpenEMR
“Critical gaps in healthcare software can expose entire patient systems in seconds.”
The OpenEMR patch addresses three vulnerabilities that impact system integrity and data security across deployments. The most severe, CVE-2026-24908, allows attackers to fully compromise the system, posing immediate risk to sensitive medical data and application control. CVE-2026-23627 introduces a high-severity issue that can further weaken system protections, while CVE-2026-24487 presents a moderate risk that still contributes to the overall attack surface.
CVE-2026-24908 has a CVSS score of 10.0, which is Critical severity. CVE-2026-23627 has a CVSS score of 7.4, which is High severity. CVE-2026-24487 has a CVSS score of 5.7, which is Medium severity. Proof-of-concept code is available for all three vulnerabilities, confirming that exploitation is practical and increasing the urgency for remediation in production environments handling healthcare data. A total of 38 CVEs have been assigned to OpenEMR.