Which versions of Pacsgear Pacs Scan are affected by EUVD-2026-41036?

Hyland PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability enabling attackers to obtain SYSTEM-level access to medical imaging servers without authentication.

Is there a public PoC exploit available for EUVD-2026-41036?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41036. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate EUVD-2026-41036?

24 hours: Identify all Hyland PACSgear PACS Scan 5.2.1 installations; restrict network access to port 22222 (PGImageExchQueue.exe service) via firewall rules; document business-critical PACS dependencies. 7 days: Implement network segmentation isolating PACS infrastructure; enable enhanced logging for port 22222 connections and service directory file modifications; scan for indicators of compromise (unauthorized DLLs, modified service binaries). 30 days: Upgrade to patched Hyland PACSgear PACS Scan version once released by vendor; verify integrity of all medical imaging data post-upgrade; conduct tabletop exercise for incident response to PACS compromise.

Pacsgear Pacs Scan EUVD-2026-41036

Q: What is the CVSS score of EUVD-2026-41036?

EUVD-2026-41036 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-58126 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-01 VulnCheck

GHSA-v3r5-hc9j-49g7

Authentication Bypass RCE Pacsgear Pacs Scan Hyland

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:51 vuln.today

CVE Published

Jul 01, 2026 - 14:39 cve.org

CRITICAL 9.3

DescriptionCVE.org

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\SYSTEM upon service restart.

AnalysisAI

Unauthenticated remote code execution in Hyland PACSgear PACS Scan 5.2.1 lets remote attackers gain SYSTEM-level control of medical imaging servers by abusing an exposed .NET Remoting TCP service (PGImageExchQueue.exe) on port 22222. The exposed service grants arbitrary file read/write with no authentication, which is chained with a DLL hijack in the PGImageExchangeQueueSvc.exe service to run code as NT AUTHORITY\SYSTEM. Publicly available exploit code exists (published by VulnCheck); there is no public exploit identified as actively exploited, as it is not listed in CISA KEV.