CVE-2026-0611
Spacelabs Healthcare Sentinel versions 10.5.x and higher, and 11.x.x before 11.6.0, have an unauthenticated remote code execution flaw. The vulnerability is triggered through a deprecated .NET Remoting HTTP channel on port 8989, allowing attackers to read, write, and execute files on the system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Spacelabs Healthcare Sentinel 10.5.x and higher, and 11.x.x before 11.6.0, typically used by healthcare IT administrators.
Real-world impact
An attacker who can reach the exposed port can read and write files, drop webshells into the IIS wwwroot directory, and run arbitrary code on the affected machine, potentially compromising patient data and system integrity.
Why this severity
The CVSS score of 9.2 reflects the high impact on confidentiality, integrity, and availability, combined with low attack complexity, no authentication, and remote exploitation.
What to do about it
- ›Ensure that port 8989 is not exposed to the network; block or close the port if it is open.
- ›Verify that the .NET Remoting HTTP channel is disabled if not required.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- Jun 2, 2026 · Jun 2, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.