Care Everywhere Gateway CVE-2026-41939

Exploitation requires network reachability to the WildFly management console on TCP port 20990 of a Care Everywhere Gateway 14.3.10 host; no authentication, credentials, or user interaction are needed because the hard-coded management credentials are identical across all installations and publicly known. The concrete prerequisite is that this management port is exposed to the attacker's network position and that WildFly's Deployments (WAR upload) function is reachable. Limiting factors: if port 20990 is firewalled off, bound to localhost, or the default credentials have been changed, exploitation is prevented; the target must be an affected 14.x Windows deployment.

All signals point to genuine, high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High, score 9.3) describes trivial network exploitation with no authentication or user interaction, and publicly available exploit code (a VulnCheck gist) lowers the skill barrier further. The vulnerability class - static, universally-shared default credentials - is highly automatable and reliable, matching an SSVC 'automatable=yes, technical impact=total' profile even though no formal SSVC decision was supplied in the input. No EPSS score was provided, and the CVE is NOT present in CISA KEV, so active exploitation is not confirmed; the accurate status is that public exploit code exists but in-the-wild use is unproven. The main mitigating factor is exposure: risk hinges on port 20990 being reachable by the attacker, so internet-exposed or flat-network deployments are at far greater risk than segmented ones.

An attacker scans healthcare-network hosts for TCP port 20990, connects to the exposed WildFly management console, and logs in using the publicly documented default credentials shared across all installations. Using the Deployments interface they upload a malicious JSP/WAR web shell, achieving remote code execution as the Windows machine account and a foothold on the health-information-exchange gateway. A public VulnCheck proof-of-concept exists, making this reproducible with low effort given the AV:N/AC:L profile.