Which versions of Hospital Quering Management are affected by CVE-2026-14162?

Advantech Hospital Queuing Management system contains a critical flaw allowing unauthenticated attackers to access complete API documentation, effectively providing attackers a detailed blueprint of…. A patch is available.

How to fix or mitigate CVE-2026-14162?

Within 24 hours: Identify and network-isolate all Advantech Hospital Queuing Management instances; restrict inbound access via firewall to administrative networks only; enable monitoring for API access attempts. Within 7 days: Contact Advantech for patch release timeline; document which systems are accessible through exposed API endpoints; evaluate whether alternate queuing solutions should be deployed as contingency. Within 30 days: Apply any vendor-released patches immediately; if no patch available by day 30, implement WAF rules blocking the API documentation endpoint; conduct security assessment of all systems identified through API endpoint exposure analysis.

Hospital Quering Management CVE-2026-14162

Q: What is the CVSS score of CVE-2026-14162?

CVE-2026-14162 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40287 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-30 twcert

GHSA-rh6c-c6qm-xq64

Authentication Bypass Information Disclosure Hospital Quering Management

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (twcert) · only source for this CVE.

CVSS VectorVendor: twcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 13:01 EUVD

Analysis Generated

Jun 30, 2026 - 12:16 vuln.today

DescriptionCVE.org

Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

AnalysisAI

Sensitive data exposure in Advantech Hospital Queuing Management lets unauthenticated remote attackers reach a specific URL and retrieve the application's API documentation, mapping out endpoints and parameters without any credentials. The flaw is rooted in missing authentication (CWE-306) on a resource that should be protected, and TWCERT rates it CVSS 4.0 9.3 (Critical). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Identify and network-isolate all Advantech Hospital Queuing Management instances; restrict inbound access via firewall to administrative networks only; enable monitoring for API access attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.