CVE-2026-48021
A critical flaw in epa4all allows attackers who can intercept the TLS connection to the ePA backend to hijack the session and read or modify all internal traffic. The vulnerability was fixed in version 2026‑05‑20. Users should update promptly.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
epa4all software before version 2026‑05‑20, used by healthcare organizations to manage electronic patient access.
Real-world impact
An attacker could read sensitive patient data, alter medication records, and inject malicious requests, potentially compromising patient safety and privacy.
Why this severity
The CVSS score of 9.1 reflects that the flaw is exploitable over the network, requires no special privileges, and gives attackers complete confidentiality and integrity of all internal traffic.
What to do about it
- 01Upgrade epa4all to version 2026‑05‑20 or later.
NVD-referenced vendor advisory
Timeline
- Jul 24, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 7d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.