{"id":"CVE-2026-16306","aliases":[],"cve":{"records":[{"id":"CVE-2026-16306","source":"certcc","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-20T14:09:38.457Z","published":"2026-11-02T15:38:11.487Z","modified":"2026-11-06T18:34:45.248Z"}],"publishers":[{"name":"certcc","role":"CNA","organizationId":"37e5125f-f79b-445b-8fad-9564f167944b","modified":"2026-11-02T15:38:11.487Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T18:34:45.248Z"}],"references":[{"url":"https://www.infinittna.com/","tags":[],"source":"certcc"}],"weaknesses":[{"id":"CWE-470","description":"CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","source":"CISA-ADP"},{"id":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T18:34:04.830572Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd.","titleSource":"certcc","descriptionSource":"certcc","description":"Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.","score":9.8,"severity":"critical","published":"2026-11-02T15:38:11.487Z","modified":"2026-11-06T18:34:45.248Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"INFINITT Healthcare","name":"System Manager","platforms":[],"versions":[{"version":"3.0.11.3","status":"affected","lessThanOrEqual":"3.0.11.5","versionType":"custom"}],"cpes":[],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2026-16306"}],"remediation":[],"references":["https://www.infinittna.com/"],"sources":[{"name":"CVE","id":"CVE-2026-16306","modified":"2026-11-06T18:34:45.248Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-16306"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-06T19:35:17.928Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:20:33.336Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-02T15:50:38.566Z","attemptedAt":"2026-11-02T15:50:38.566Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-02T15:50:39.250Z","attemptedAt":"2026-11-02T15:50:39.250Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-02T15:50:35.147Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-02T15:50:39.523Z","attemptedAt":"2026-11-02T15:50:39.523Z"}],"evidence":[],"aiSummary":{"text":"INFINITT Healthcare Co., Ltd.'s IModular.exe URI handler in INFINITT PACS System Manager version 3.0.11.3 is affected, potentially allowing a remote unauthenticated attacker to invoke unintended functionality via a crafted imodular:// URI. The stated impact is arbitrary code execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T19:51:55.895Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-16306"}]}}