CVE-2026-105667

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

• CWE-306

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json
• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105652Ghost is a Node.js content management system. From 0.7.2 unt…3.1
• CVE-2026-105659Uncontrolled Resource Consumption vulnerability in mtrudel b…8.7
• CVE-2026-10566A weakness has been identified in FoundationAgents MetaGPT u…5.3
• CVE-2026-105660Improper Validation of Syntactic Correctness of Input vulner…6.9
• CVE-2026-105661Requesting `/{username}/-/repositories` for an individual us…5.3
• CVE-2026-105664The endpoint exposes an observable response discrepancy when…5.3
• CVE-2026-105668Protection Mechanism Failure vulnerability in hexpm hex allo…7.1
• CVE-2026-10567A security vulnerability has been detected in 1Panel-dev Cor…3.5
• CVE-2026-105672TP-Link Tapo C325WB V2 contains an unauthenticated authoriza…8.7
• CVE-2026-105673An unauthenticated denial-of-service vulnerability exists in…7.1
• CVE-2026-105674TP-Link Tapo C325WB V2 generates the pre-shared key used by …8.7
• CVE-2026-105675Ghost is a Node.js content management system. From 4.39.0 un…7.5