# INFINITT PACS flaws enable privilege escalation

Published: 2026-11-02 · Severity: routine · Sectors: Healthcare
Canonical: https://vorant.io/reports/060ee198-35b8-5cf4-a40b-610b29b95d07/infinitt-pacs-flaws-enable-privilege-escalation
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Two vulnerabilities in INFINITT PACS System Manager allow local privilege escalation and remote code execution via a malicious URI scheme; no known exploitation yet.

Source: kb.cert.org — https://kb.cert.org/vuls/id/203719

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC published VU#203719 detailing two vulnerabilities affecting INFINITT PACS System Manager, a medical imaging platform used in healthcare settings to store, retrieve, and display patient scans. CVE-2026-16305 involves insecure file permissions on execlist.txt, which is read and executed by SmartExecute.exe during the update process; a low-privileged local attacker can modify this file to inject arbitrary commands that execute with administrative privileges when a user approves an update prompt (UAC). CVE-2026-16306 stems from unsafe command dispatch in IModular.exe via the registered imodular:// URI scheme, where the application executes a cmd parameter from a crafted link without validation. This can be abused to access attacker-controlled files, run programs from local or network locations, or force the application to connect to an attacker-controlled SignalR endpoint, enabling unauthorized outbound communication and potential data exposure.

CVE-2026-16305 requires local access and user interaction with an update approval, while CVE-2026-16306 requires social engineering a user into clicking a crafted imodular:// link, making it a remote vector despite needing local execution privileges of the victim. Both could be chained to escalate privileges, establish persistence, or pivot further into a healthcare network. CERT/CC states there are no indications of in-the-wild exploitation at this time.

INFINITT Healthcare has released fixed versions — System Manager 3.0.12.3 and 3.0.12.5 — addressing both vulnerabilities. Organizations running affected versions (3.0.11.3 and 3.0.11.5) should prioritize patching given the healthcare sector context and potential for privilege escalation on clinical workstations. Defenders should also monitor for anomalous execlist.txt modifications and unexpected imodular:// link invocations or outbound SignalR connections as detection opportunities.

## Mentioned in this report

- Vulnerabilities: CVE-2026-16305, CVE-2026-16306

## Detection guidance (public sample)

### INFINITT execlist.txt Modified by Unexpected Process

ATT&CK: T1574

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows file_event logs. Status: experimental. Generated from the report; not run against telemetry.

Detects writes to execlist.txt, the file read and executed by INFINITT SmartExecute.exe during updates, which can be abused to inject commands (CVE-2026-16305). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: INFINITT execlist.txt Modified by Unexpected Process
id: b728f7de-7786-5f58-ad63-5c59b98e0c22
status: experimental
description: Detects creation or modification of execlist.txt, the command list consumed
  by INFINITT SmartExecute.exe during the update process. A low-privileged user writing
  to this file can inject commands that run with administrative rights (CVE-2026-16305).
  Writes by the vendor updater itself are excluded.
references:
- https://kb.cert.org/vuls/id/203719
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \execlist.txt
  filter_vendor:
    Image|endswith:
    - \SmartExecute.exe
    - \msiexec.exe
  condition: selection and not filter_vendor
falsepositives:
- INFINITT software installation or upgrade routines that stage execlist.txt via a
  different helper process
- Administrators manually editing the update list
level: medium
author: Vorant
```

### INFINITT SmartExecute Spawning Shell or Script Interpreter

ATT&CK: T1068

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

SmartExecute.exe launching command shells or script hosts, indicating abuse of a tampered execlist.txt for elevated command execution (CVE-2026-16305). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: INFINITT SmartExecute Spawning Shell or Script Interpreter
id: 62edd076-b24f-5cc2-a7f4-553c0ff29011
status: experimental
description: Detects INFINITT SmartExecute.exe starting a command shell, PowerShell
  or other living-off-the-land interpreter. This is consistent with injected commands
  in execlist.txt running with administrative privileges after a UAC update approval
  (CVE-2026-16305).
references:
- https://kb.cert.org/vuls/id/203719
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \SmartExecute.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legitimate INFINITT update scripts that call cmd.exe for service restarts
level: high
author: Vorant
```

### INFINITT IModular Spawning Shell or Script Interpreter via URI Handler

ATT&CK: T1204.001

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

IModular.exe, invoked through the imodular:// URI scheme, launching shells or interpreters, indicating a crafted link abusing the cmd parameter (CVE-2026-16306). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: INFINITT IModular Spawning Shell or Script Interpreter via URI Handler
id: 23ef6949-277a-5def-a050-c70666c19470
status: experimental
description: Detects INFINITT IModular.exe starting a command shell or script interpreter.
  IModular executes a cmd parameter from crafted imodular:// links without validation
  (CVE-2026-16306), allowing attacker-chosen programs to run from local or network
  locations in the context of the victim user.
references:
- https://kb.cert.org/vuls/id/203719
tags:
- attack.execution
- attack.t1204.001
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \IModular.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legitimate INFINITT module launchers that wrap their startup in cmd.exe
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/203719

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/060ee198-35b8-5cf4-a40b-610b29b95d07/infinitt-pacs-flaws-enable-privilege-escalation.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup