CERT/CC discloses two critical flaws in INFINITT PACS

Two critical vulnerabilities have been disclosed affecting INFINITT PACS, the hospital imaging platform used by thousands of sites worldwide. CERT/CC issued a security notice on 2 November 2026 detailing two flaws in INFINITT System Manager that could enable remote or local code execution and, in turn, full administrative control. The report emphasises that there are no known active exploits in customer networks at this time, and researchers have not published public exploit code for either issue.

The two CVEs are CVE-2026-16305 and CVE-2026-16306. CVE-2026-16305 is a local privilege escalation flaw within the update manager: an improperly protected update manifest (execlist.txt) could allow a local attacker to execute commands with administrative privileges when an update is approved, via SmartExecute.exe reading commands during updates and potential weaknesses in file permissions.

CVE-2026-16306 is a remote code execution issue in IModular.exe, caused by an unsafe dispatch through the imodular:// URI scheme, which could let an attacker lure a user into clicking a malicious link and cause IModular.exe to run code from local folders or network shares, including an outbound call to an external SignalR server. The affected INFINITT PACS versions are System Manager 3.0.11.3 and 3.0.11.5.

Patches have been released; administrators should upgrade to System Manager 3.0.12.3 or 3.0.12.5 and apply additional network hardening to block untrusted outbound traffic.