Openemr CVE-2026-32238

Requires authenticated access with high-privilege role (administrator or backup user) in OpenEMR versions prior to 8.0.0.2. Attacker must have permission to access the backup functionality to inject arbitrary OS commands executed with application privileges.

While the CVSS 9.1 score indicates critical severity due to high impact across confidentiality, integrity, and availability with scope change, the real-world risk is moderated by the requirement for high privileges (PR:H). The network-based attack vector (AV:N) with low complexity (AC:L) suggests easy exploitation once authenticated, but the attacker must first obtain administrative credentials. No EPSS data, KEV listing, or public exploits are currently available, indicating this is not being actively exploited in the wild. The vulnerability follows a common pattern of command injection flaws that are straightforward to exploit once discovered but require significant access rights, making it a priority for organizations using OpenEMR but not an immediate crisis.

An attacker who has compromised or obtained high-privilege credentials to an OpenEMR installation could navigate to the backup functionality and inject malicious commands through unvalidated input fields. These commands would execute with the web server's privileges, potentially allowing the attacker to access sensitive patient data, modify health records, or pivot to other systems on the network. Given the low attack complexity and network-based vector, exploitation would be straightforward once administrative access is obtained.