Which versions of Care Everywhere Gateway are affected by CVE-2026-41939?

Care Everywhere Gateway 14.3.10 contains a critical remote code execution vulnerability (CVSS 9.3) that allows unauthenticated attackers to gain system-level access through hardcoded credentials in…

Is there a public PoC exploit available for CVE-2026-41939?

Yes, a public proof-of-concept exploit is available for CVE-2026-41939. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-41939?

Within 24 hours, identify all Care Everywhere Gateway 14.3.10 instances in production and non-production environments, restrict network access to port 20990 via firewall rules (blocking external traffic), and enable security monitoring on these systems for suspicious WildFly console access attempts. Within 7 days, assess the feasibility of upgrading to Care Everywhere Gateway version 15.x or later (which remediates this vulnerability), engage with Epic support to obtain patch details for the latest versions, and develop a detailed migration plan including testing windows and rollback procedures. Within 30 days, execute the upgrade to a patched release or, if technically infeasible, document the business justification for continued operation and implement compensating controls.

Care Everywhere Gateway CVE-2026-41939

Q: What is the CVSS score of CVE-2026-41939?

CVE-2026-41939 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-50439 CRITICAL

Use of Default Credentials (CWE-1392)

2026-07-29 VulnCheck

GHSA-pr7r-jf2h-77g3

RCE Microsoft Care Everywhere Gateway

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Publicly known default credentials give unauthenticated network access (PR:N/AV:N/AC:L), and WAR deployment yields full host code execution, so C/I/A are all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 18:30 vuln.today

CVE Published

Jul 29, 2026 - 17:39 cve.org

CRITICAL 9.3

DescriptionCVE.org

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed the vulnerable finding.

AnalysisAI

Remote code execution in Care Everywhere Gateway 14.3.10 stems from hard-coded, install-invariant credentials in its bundled WildFly 8.2.0.Final management interface (port 20990), letting unauthenticated remote attackers log into the management console and deploy a malicious WAR to run code as the Windows machine account. The affected 14.x branch reached end-of-life in 2017 and later releases remediate the issue. Publicly available exploit code exists (VulnCheck), and given AV:N/AC:L/PR:N/UI:N the barrier to exploitation is minimal, though this is not listed in CISA KEV.

Technical ContextAI

The flaw is classified as CWE-1392 (Use of Default Credentials). Care Everywhere Gateway embeds Red Hat WildFly (formerly JBoss AS) 8.2.0.Final as its application server, and its administrative management interface is exposed on TCP port 20990 with a default credential pair that is identical across every installation. WildFly's Deployments feature is designed to hot-deploy Java web application archives (WAR files); an attacker who can authenticate to the management console inherits that legitimate capability to upload and activate arbitrary server-side code. Because the WildFly process runs under the host's Windows machine account, deployed code executes with that account's privileges on the Windows host.

RemediationAI

The vendor indicates that releases after the end-of-life 14.x.x branch have addressed this finding, so the primary fix is to upgrade off 14.x to a current, supported release; no exact fixed version number is given in the available data, so confirm the target build with the vendor. As compensating controls where immediate upgrade is impossible: restrict network access to TCP port 20990 with host and perimeter firewall rules so the WildFly management interface is unreachable from untrusted networks (side effect: any legitimate remote management tooling must be whitelisted), bind the management interface to localhost only if the deployment permits, and - if the platform allows - rotate or remove the default WildFly management credentials and disable the Deployments capability for the management realm (side effect: breaks hot-deploy-based administration). Reference the VulnCheck advisory at https://www.vulncheck.com/advisories/care-everywhere-gateway-hard-coded-credentials-rce-via-wildfly for specifics.