Spacelabs Sentinel CVE-2026-0611

The vulnerable .NET Remoting HTTP channel on TCP/8989 must be network-reachable to the attacker, which per the description is NOT the case in a default Sentinel installation - exploitation specifically requires that port 8989 has been deliberately made network-accessible through configuration changes or permissive firewall/network policy. The Sentinel installation must be version 10.5.x or higher in the 10.x line, or any 11.x build prior to 11.6.0. The attacker must be able to issue HTTP requests to port 8989 (so attacker must be on a network path that reaches it - internet, clinical LAN, or VPN). No authentication is required (PR:N), no user interaction is required (UI:N), and attack complexity is low (AC:L). The principal limiting factor reducing real-world exposure is the non-default port exposure (reflected as AT:P in the CVSS 4.0 vector); sites that never exposed port 8989 are not exploitable over the network even on vulnerable versions.

The CVSS 4.0 score of 9.2 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H reflects network reachability, low complexity, no privileges, and no user interaction, with full confidentiality, integrity, and availability impact on the vulnerable component - and crucially the AT:P (Attack Requirements: Present) bit acknowledges the non-default configuration prerequisite. EPSS and KEV data are not provided in the input, so probabilistic exploitation likelihood and CISA active-exploitation status are unknown at time of analysis. No public exploit identified at time of analysis, though VulnCheck (the reporter) has published an advisory that may contain technical detail enabling rapid weaponization. Real-world risk is bimodal: for Sentinel deployments where port 8989 has been intentionally exposed (e.g., for legacy integrations or misconfigured network segmentation), this is a critical priority due to unauthenticated RCE in a clinical system; for default deployments the immediate internet-facing exposure is limited, but internal-network attackers who reach the segment can still exploit it trivially.

An attacker with network reach to a Sentinel server that has had TCP/8989 explicitly exposed (for example, through a misconfigured firewall rule or an integration the customer deliberately enabled) sends a crafted .NET Remoting request specifying a URI endpoint that invokes the file-write primitive, dropping an ASPX webshell into the IIS wwwroot directory. The attacker then requests the webshell over HTTP, causing IIS to compile and execute it under the application pool identity, yielding interactive command execution on a clinical system that holds patient cardiology data. No public exploit identified at time of analysis, but the technique (writing .aspx via arbitrary-file-write to achieve RCE) is well-documented and likely to be reproduced quickly from VulnCheck's advisory.