CVE-2026-19876 INFINITT Healthcare CVE debrief

Who should care

Defenders responsible for INFINITT ULite deployments should assess exposure and apply the available fix. Security teams should monitor for potential exploitation attempts. Defenders should prioritize verifying exposure of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier, and applying the available fix in ULite 5.0.2.1 BN50. Operators of affected systems should review compensating controls and verify version exposure.

Why it matters

CVE-2026-19876 is a reflected cross-site scripting (XSS) vulnerability in INFINITT ULite 5.0.2.1_BN48_20260528 and earlier. Defenders should prioritize verifying exposure and applying the available fix. The vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in victim browsers. Limited information is available on potential exploitation or impact.

• Execution of arbitrary JavaScript in victim browsers
• Potential for unauthorized actions on behalf of victims
• Possible theft of sensitive information
• Need for verification of INFINITT ULite version and exposure

Technical summary

The vulnerability exists due to an unsanitized request parameter being reflected without output encoding in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier. This allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. The issue arises in the login/SSO error page. A fix is available in ULite 5.0.2.1 BN50. Defenders should prioritize verifying exposure of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier, and applying the available fix.

Defensive priority

Defenders should prioritize verifying exposure of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier, and applying the available fix in ULite 5.0.2.1 BN50.

Recommended defensive actions

• Verify INFINITT ULite version and check for exposure
• Apply available fix in ULite 5.0.2.1 BN50
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information on potential exploitation or impact is limited. Defenders should verify INFINITT ULite version and exposure. Limited information is available, so explicit evidence-limit language and defensive verification tasks are necessary. The vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in victim browsers. The issue arises from an unsanitized request parameter being reflected without output encoding in the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.