EUVD-2026-35530
GHSA-7w62-gvgg-pvvq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Nuance PowerScribe allows unauthenticated network attackers to run arbitrary code by submitting maliciously crafted serialized objects to the application. The flaw is a CWE-502 untrusted-data deserialization issue carrying a critical CVSS 9.8 score, reported through Microsoft Security Response Center; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Network reachability to the vulnerable Nuance PowerScribe service is required, along with the ability to submit a serialized object to whichever endpoint performs the unsafe deserialization; per CVSS PR:N and UI:N, no authentication and no user interaction are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the worst-case profile: network-reachable, low-complexity, no authentication, no user interaction, and full compromise of confidentiality, integrity, and availability - the standard 9.8 critical pattern for unauth RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a hospital's clinical VLAN - obtained via a compromised workstation, a misconfigured VPN, or a malicious insider - sends a crafted serialized payload containing a known gadget chain to the PowerScribe service port. Deserialization triggers code execution under the PowerScribe service account, giving the attacker a foothold on a server that handles radiology reports and is typically integrated with PACS, RIS, and EHR systems, enabling lateral movement into PHI repositories or pre-positioning for ransomware. |
| Remediation | Patch availability per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26142 should be reviewed and applied - specific fix version is not stated in the provided data and must be retrieved from MSRC. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all PowerScribe installations and restrict network-layer access to essential clinical departments only; enable detailed application logging and alert on deserialization-related events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today