What is the CVSS score of EUVD-2026-35530?

EUVD-2026-35530 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Nuance PowerScribe are affected by EUVD-2026-35530?

Nuance PowerScribe, a mission-critical clinical radiology reporting platform deployed across hospital networks, is vulnerable to unauthenticated remote code execution that could compromise protected…. A patch is available.

How to fix or mitigate EUVD-2026-35530?

Within 24 hours: Inventory all PowerScribe installations and restrict network-layer access to essential clinical departments only; enable detailed application logging and alert on deserialization-related events. Within 7 days: Deploy network segmentation isolating PowerScribe systems from general hospital networks; enforce re-authentication for all access via VPN or identity provider; document current system state and verify backup integrity. Within 30 days: Contact Nuance for patch availability timeline and interim security updates; complete risk assessment for temporary service restrictions or clinical workflow modifications pending remediation.

Nuance PowerScribe EUVD-2026-35530

| CVE-2026-26142 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-09 secure@microsoft.com

GHSA-7w62-gvgg-pvvq

Deserialization Nuance Powerscribe 360 Nuance Powerscribe One

9.8

CVSS 3.1 · Vendor: microsoft

Temporal: 8.5

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.5 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:30 vuln.today

DescriptionCVE.org

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Nuance PowerScribe allows unauthenticated network attackers to run arbitrary code by submitting maliciously crafted serialized objects to the application. The flaw is a CWE-502 untrusted-data deserialization issue carrying a critical CVSS 9.8 score, reported through Microsoft Security Response Center; no public exploit identified at time of analysis. Because PowerScribe is a clinical radiology reporting platform widely deployed in hospital environments, successful exploitation could compromise systems handling protected health information.

Technical ContextAI

Nuance PowerScribe is a speech-recognition-driven radiology reporting platform used by hospitals and imaging centers to dictate, generate, and sign diagnostic reports; following Microsoft's 2022 acquisition of Nuance, the product is now serviced through MSRC. The root cause is CWE-502 (Deserialization of Untrusted Data), a class of bug where the application reconstructs object graphs from attacker-controlled byte streams without validating the type or content, allowing gadget chains (commonly in .NET BinaryFormatter, Java readObject, or similar serializers) to trigger arbitrary method invocations during the deserialization process itself. No CPE strings were published with this advisory, so exact affected components within the PowerScribe product family (PowerScribe 360, PowerScribe One, etc.) cannot be enumerated from the available data.

RemediationAI

Patch availability per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26142 should be reviewed and applied - specific fix version is not stated in the provided data and must be retrieved from MSRC. As compensating controls until patching is complete, restrict network reachability to the PowerScribe application and management endpoints to clinical workstations and integration servers only via firewall ACLs or network segmentation (trade-off: may break legitimate integrations with PACS/RIS/EHR systems if scope is too narrow), place the service behind an authenticating reverse proxy or VPN if it is currently directly accessible (trade-off: adds latency and login friction for radiologists who rely on rapid sign-in workflows), and monitor application logs and network flows for unexpected serialized payloads or unusual child processes spawned by the PowerScribe service account. Avoid disabling the deserialization endpoint blindly, as PowerScribe's voice and reporting workflows depend on inter-component messaging that may use the same channel.