Le-yan MPMS CVE-2026-78685

Exploitation requires that a user with an active or credentialed session on the Le-yan Medical Practice Management System open an attacker-crafted HTML page in their browser; the CVSS 4.0 UI:A metric confirms this interaction is mandatory and the attack cannot be automated against passive targets. The MPMS server must be network-reachable from the browser executing the crafted page - whether via internet exposure or internal network depending on deployment. No special non-default server configuration is stated as required. Limiting factors: the mandatory user interaction step means the attacker must succeed at social engineering (phishing, malicious ad, typosquatting) before exploitation is possible; if the MPMS is restricted to an isolated intranet, the attacker's ability to reach both the victim and the server simultaneously is constrained. The exact authentication level of the required victim session is not explicitly stated in the available description, and cannot be confirmed from the current data.

The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) reflects high severity with complete compromise of the vulnerable system achievable. The most meaningful real-world moderating factor is UI:A - exploitation is not fully automated and requires an attacker to successfully social-engineer a legitimate system user into opening a crafted page. No EPSS data was provided in the available intelligence, no CISA KEV listing exists, and no public POC has been identified, collectively suggesting no confirmed widespread active exploitation at time of analysis. However, the medical context materially elevates downstream consequences: OS-level compromise of a medical practice management system likely exposes protected health information (PHI), patient records, and billing data, triggering regulatory obligations beyond typical breach scenarios. The wildcard CPE version string means no safe floor version is identifiable - all deployed instances should be considered vulnerable. EPSS and exploit maturity data are absent, which limits confidence in exploitation probability.

An attacker registers a domain and hosts a webpage containing crafted HTML or JavaScript that, when loaded by a user with an active Le-yan MPMS session, silently submits a malformed request to the MPMS server. Because the server does not verify the origin of the communication channel (CWE-940), it treats the cross-origin request as legitimate and executes the embedded OS command payload with the application's process privileges. The attacker - who holds no credentials - achieves full remote code execution on the server through the victim's browser as the sole intermediary.