Critical RCE Vulnerability in OpenEMR Exposes Servers to Attacks

cvefeed.io

Critical RCE Vulnerability in OpenEMR Exposes Servers to Attacks

First seen 4 Aug 2026, 14:51 UTC • •72.0

Article Content

1 / 5

Browse articles

ThreatCluster •August 5, 2026 at 14:37 UTC

•CVE-2026-39932 allows RCE in OpenEMR versions up to 8.2.0 due to eval() injection.
•Attackers can execute commands as the web server user by exploiting the vulnerability.
•Immediate upgrade to OpenEMR 8.2.1 or later is recommended to mitigate risks.

A critical remote code execution vulnerability, CVE-2026-39932, affects OpenEMR versions up to 8.2.0. The flaw arises from an unsafe eval() call in the document category tree component, allowing attackers to execute arbitrary PHP code stored in the categories database table. This vulnerability can be exploited by authenticated administrators to alter the id column type to VARCHAR and insert malicious PHP payloads. The exploit can be triggered by both authenticated and unauthenticated page activities, leading to command execution as the web server user. The CVSS scores for this vulnerability are 9.4 (CVSS 4.0) and 9.1 (CVSS 3.1). Users are advised to upgrade to OpenEMR version 8.2.1 or later and review their database integrity and access controls. The vulnerability was publicly reported on August 3, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 95d ago How this analysis works

Timeline

2026-08-03

CVE-2026-39932 published

A critical RCE vulnerability in OpenEMR was disclosed, affecting versions up to 8.2.0.

More articles in this cluster (4)

Threat Graph

8 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Sql Injection
T1059.008 - Network Device CLI
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-39932

Weakness (2)

CWE-89 - SQL Injection
CWE-94 - Code Injection

Affected Platform (2)

OpenEMR
PHP

Relationships

CVE-2026-39932 targets OpenEMR
CVE-2026-39932 targets PHP
Sql Injection targets OpenEMR
Sql Injection targets PHP
T1059.008 - Network Device CLI targets OpenEMR
T1059.008 - Network Device CLI targets PHP
T1190 - Exploit Public-Facing Application targets OpenEMR
T1190 - Exploit Public-Facing Application targets PHP
CVE-2026-39932 related to CWE-89 - SQL Injection
CVE-2026-39932 related to CWE-94 - Code Injection

Following this threat?

Track CVE-2026-39932 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…

GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…