Which versions of Hospital Queuing Management are affected by CVE-2026-14161?

Advantech Hospital Queuing Management contains an unauthenticated information disclosure vulnerability (CVE-2026-14161, CVSS 8.7) that exposes internal API documentation to remote attackers without…. A patch is available.

How to fix or mitigate CVE-2026-14161?

Within 24 hours: Inventory all Advantech Hospital Queuing Management deployments and determine internet accessibility and patient-dependency criticality. Within 7 days: Implement network access restrictions via firewall rules or VPN enforcement; deploy WAF rules blocking requests to vulnerable documentation endpoints; enable monitoring for reconnaissance activity. Within 30 days: Monitor Advantech security advisories for patch release; prepare update process to deploy within 48 hours of patch availability.

Hospital Queuing Management CVE-2026-14161

Q: What is the CVSS score of CVE-2026-14161?

CVE-2026-14161 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40286 HIGH

Information Exposure (CWE-200)

2026-06-30 twcert

GHSA-h3wp-wq8p-j642

Information Disclosure Hospital Queuing Management Advantech

8.7

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Unauthenticated network access with no interaction (AV:N/AC:L/PR:N/UI:N); confidentiality set to Low (C:L) because only API documentation, not sensitive data, is exposed, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 13:01 EUVD

Analysis Generated

Jun 30, 2026 - 12:15 vuln.today

DescriptionCVE.org

Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

AnalysisAI

Information disclosure in Advantech Hospital Queuing Management allows unauthenticated remote attackers to retrieve internal API documentation by requesting a specific URL, exposing the application's API surface, endpoints, and parameters. The flaw carries a high CVSS 4.0 base score of 8.7 driven entirely by confidentiality impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The leaked documentation primarily serves as reconnaissance that lowers the barrier to attacking other endpoints of this healthcare queuing platform.

Technical ContextAI

Advantech's Hospital Queuing Management is a healthcare-facility patient flow/queuing application (CPE: cpe:2.3:a:advantech:hospital_queuing_management). The weakness maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): a sensitive resource - here the application's API documentation - is reachable without any authentication or access control. This typically arises when developer or framework-generated API reference pages (for example auto-generated docs, schema, or endpoint listings) are deployed to production and left served on a predictable or guessable URL path, so that anyone able to reach the web service can enumerate the full API contract.

RemediationAI

Consult the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11012-63761-2.html and https://www.twcert.org.tw/tw/cp-132-11011-999eb-1.html) and apply the vendor-provided fixed version from Advantech once obtained - no exact fixed version is stated in the available data, so confirm the patched build directly with Advantech (No vendor-released patch version independently confirmed at time of analysis). As an immediate compensating control, block or restrict access to the specific API documentation URL at the web server or reverse proxy (return 403/404 for that path), or disable the API documentation/reference endpoint in the application configuration so it is not served in production; the trade-off is loss of in-app API reference for legitimate developers, which is acceptable in production. Additionally, place the queuing management web interface behind network segmentation or VPN/IP allow-listing so it is not exposed to untrusted networks or the internet, accepting that this restricts remote administrative or integration access.