INFINITT PACS flaws enable privilege escalation

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Two vulnerabilities in INFINITT PACS System Manager allow local privilege escalation and remote code execution via a malicious URI scheme; no known exploitation yet.

Sourcekb.cert.org — open the original

CERT/CC published VU#203719 detailing two vulnerabilities affecting INFINITT PACS System Manager, a medical imaging platform used in healthcare settings to store, retrieve, and display patient scans. CVE-2026-16305 involves insecure file permissions on execlist.txt, which is read and executed by SmartExecute.exe during the update process; a low-privileged local attacker can modify this file to inject arbitrary commands that execute with administrative privileges when a user approves an update prompt (UAC). CVE-2026-16306 stems from unsafe command dispatch in IModular.exe via the registered imodular:// URI scheme, where the application executes a cmd parameter from a crafted link without validation. This can be abused to access attacker-controlled files, run programs from local or network locations, or force the application to connect to an attacker-controlled SignalR endpoint, enabling unauthorized outbound communication and potential data exposure.

CVE-2026-16305 requires local access and user interaction with an update approval, while CVE-2026-16306 requires social engineering a user into clicking a crafted imodular:// link, making it a remote vector despite needing local execution privileges of the victim. Both could be chained to escalate privileges, establish persistence, or pivot further into a healthcare network. CERT/CC states there are no indications of in-the-wild exploitation at this time.

INFINITT Healthcare has released fixed versions — System Manager 3.0.12.3 and 3.0.12.5 — addressing both vulnerabilities. Organizations running affected versions (3.0.11.3 and 3.0.11.5) should prioritize patching given the healthcare sector context and potential for privilege escalation on clinical workstations. Defenders should also monitor for anomalous execlist.txt modifications and unexpected imodular:// link invocations or outbound SignalR connections as detection opportunities.

title: INFINITT execlist.txt Modified by Unexpected Process
id: b728f7de-7786-5f58-ad63-5c59b98e0c22
status: experimental
description: Detects creation or modification of execlist.txt, the command list consumed
  by INFINITT SmartExecute.exe during the update process. A low-privileged user writing
  to this file can inject commands that run with administrative rights (CVE-2026-16305).
  Writes by the vendor updater itself are excluded.
references:
- https://kb.cert.org/vuls/id/203719
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \execlist.txt
  filter_vendor:
    Image|endswith:
    - \SmartExecute.exe
    - \msiexec.exe
  condition: selection and not filter_vendor
falsepositives:
- INFINITT software installation or upgrade routines that stage execlist.txt via a
  different helper process
- Administrators manually editing the update list
level: medium
author: Vorant

title: INFINITT SmartExecute Spawning Shell or Script Interpreter
id: 62edd076-b24f-5cc2-a7f4-553c0ff29011
status: experimental
description: Detects INFINITT SmartExecute.exe starting a command shell, PowerShell
  or other living-off-the-land interpreter. This is consistent with injected commands
  in execlist.txt running with administrative privileges after a UAC update approval
  (CVE-2026-16305).
references:
- https://kb.cert.org/vuls/id/203719
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \SmartExecute.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legitimate INFINITT update scripts that call cmd.exe for service restarts
level: high
author: Vorant

title: INFINITT IModular Spawning Shell or Script Interpreter via URI Handler
id: 23ef6949-277a-5def-a050-c70666c19470
status: experimental
description: Detects INFINITT IModular.exe starting a command shell or script interpreter.
  IModular executes a cmd parameter from crafted imodular:// links without validation
  (CVE-2026-16306), allowing attacker-chosen programs to run from local or network
  locations in the context of the victim user.
references:
- https://kb.cert.org/vuls/id/203719
tags:
- attack.execution
- attack.t1204.001
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \IModular.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legitimate INFINITT module launchers that wrap their startup in cmd.exe
level: high
author: Vorant

Source reporting: https://kb.cert.org/vuls/id/203719

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.