CVE-2026-19877 INFINITT Healthcare CVE debrief

Who should care

Defenders responsible for INFINITT ULite deployments, particularly those in medical imaging environments, should assess exposure and prioritize remediation. This includes verifying INFINITT ULite image-share link configurations to ensure strong passwords and rate limiting on password attempts. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated

Why it matters

CVE-2026-19877 allows unauthenticated remote attackers to brute-force image-share link passwords in INFINITT ULite 5.0.2.1_BN48_20260528 and earlier, potentially gaining unauthorized access to shared medical images. Defenders should prioritize verifying exposure, assessing password strength, and updating to version 5.0.2.1 BN50 or later.

• Potential unauthorized access to shared medical images through brute-force attacks on image-share link passwords.
• Need to verify INFINITT ULite image-share link configurations and password strength.
• Possible impact on patient confidentiality and data integrity if medical images are accessed without authorization.

Technical summary

INFINITT ULite 5.0.2.1_BN48_20260528 and earlier uses low-entropy passwords for image-share links and does not restrict repeated password attempts, allowing brute-force attacks within the link validity window. This vulnerability allows an unauthenticated remote attacker to potentially gain unauthorized access to shared medical images. Defenders should prioritize verifying exposure of INFINITT ULite image-share links and assess the use of weak passwords and lack of rate limiting on password attempts. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected version.

Defensive priority

Defenders should prioritize verifying exposure of INFINITT ULite image-share links and assess the use of weak passwords and lack of rate limiting on password attempts.

Recommended defensive actions

• Verify INFINITT ULite image-share link configurations to ensure strong passwords and rate limiting on password attempts.
• Assess exposure of INFINITT ULite image-share links to unauthorized access.
• Update INFINITT ULite to version 5.0.2.1 BN50 or later.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected version. However, additional information on the impact and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.