Openemr CVE-2026-33931

While the CVSS score of 6.5 reflects high confidentiality impact, multiple risk signals suggest limited real-world exploitation likelihood. The EPSS score of 0.03% (7th percentile) indicates very low predicted exploitation probability in the wild. The attack requires low complexity and only low privileges (authenticated portal access), but the barrier to entry-needing legitimate patient portal credentials-narrows the attacker pool to individuals with legitimate access. No CISA KEV confirmation has been noted in the provided intelligence, and no public proof-of-concept exploit has been identified at the time of analysis. This is a prototypical case of high CVSS but low exploitation probability: the vulnerability is straightforward to patch and fix, affects only confidentiality (no data modification or system availability impact), and requires pre-existing patient authentication, reducing threat actor motivation and capability. Patching should be scheduled during normal maintenance windows but does not warrant emergency response.

A legitimate OpenEMR patient logs into the patient portal and iterates through sequential or random recid parameter values in the payment page URL, systematically accessing other patients' invoice records, billing amounts, and payment card metadata without authorization. Exploitation requires only network access and valid patient portal credentials; the low CVSS complexity and requirement for legitimate authentication means an attacker with a single patient account can enumerate and exfiltrate payment records from other patients through a simple parameter manipulation attack. No public exploit code has been identified, reducing the likelihood of opportunistic exploitation by low-skill actors.