Openemr CVE-2026-33917

Requires authenticated user account in OpenEMR versions prior to 8.0.0.3. Attacker must have login credentials to access the CAMOS form ajax_save endpoint. Remote exploitation via HTTP; no victim interaction needed beyond attacker possessing valid authentication.

The CVSS v3.1 score of 8.8 (High) reflects significant technical impact with network attack vector (AV:N), low complexity (AC:L), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, the requirement for low-privilege authentication (PR:L) provides partial mitigation as the attacker must first obtain valid credentials. Real-world risk signals are mixed: EPSS probability of 0.03% (8th percentile) indicates very low observed exploitation likelihood in the wild, and no public exploit identified at time of analysis. The vulnerability is not listed in CISA KEV, confirming no known active exploitation campaigns. Despite the high CVSS score, the combination of authentication requirements, low EPSS probability, patch availability, and absence of public exploits suggests this is a moderate priority rather than emergency-critical. Organizations using OpenEMR should prioritize patching within standard maintenance windows, with accelerated timelines for internet-facing instances or environments with weak credential controls where the PR:L barrier is more easily overcome.

An authenticated attacker with low-privilege credentials (such as a standard clinical user account) accesses the OpenEMR CAMOS form interface and intercepts the ajax_save request. By injecting malicious SQL syntax into vulnerable form parameters, the attacker executes arbitrary database queries to extract the entire patient database containing protected health information (PHI), modify medical records to alter treatment documentation, or delete critical data causing service disruption. The attack requires no user interaction and can be automated once valid credentials are obtained through phishing, credential stuffing, or insider access.