Which versions of Hospital Quering Management are affected by CVE-2026-14162?

Advantech Hospital Queuing Management system contains a critical flaw allowing unauthenticated attackers to access complete API documentation, effectively providing attackers a detailed blueprint of…. A patch is available.

How to fix or mitigate CVE-2026-14162?

Within 24 hours: Identify and network-isolate all Advantech Hospital Queuing Management instances; restrict inbound access via firewall to administrative networks only; enable monitoring for API access attempts. Within 7 days: Contact Advantech for patch release timeline; document which systems are accessible through exposed API endpoints; evaluate whether alternate queuing solutions should be deployed as contingency. Within 30 days: Apply any vendor-released patches immediately; if no patch available by day 30, implement WAF rules blocking the API documentation endpoint; conduct security assessment of all systems identified through API endpoint exposure analysis.

Hospital Quering Management CVE-2026-14162

Q: What is the CVSS score of CVE-2026-14162?

CVE-2026-14162 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40287 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-30 twcert

GHSA-rh6c-c6qm-xq64

Authentication Bypass Information Disclosure Hospital Quering Management Advantech

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (twcert) · only source for this CVE.

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 13:01 EUVD

Analysis Generated

Jun 30, 2026 - 12:16 vuln.today

DescriptionCVE.org

Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

AnalysisAI

Sensitive data exposure in Advantech Hospital Queuing Management lets unauthenticated remote attackers reach a specific URL and retrieve the application's API documentation, mapping out endpoints and parameters without any credentials. The flaw is rooted in missing authentication (CWE-306) on a resource that should be protected, and TWCERT rates it CVSS 4.0 9.3 (Critical). No public exploit is identified at time of analysis, but the exposed API documentation provides reconnaissance that materially lowers the barrier to follow-on attacks.