# Multiple RCE vulnerabilities in Sante PACS Server 4.1.0 Published: 2026-06-09 · Severity: elevated · Sectors: healthcare Canonical: https://vorant.io/reports/29808f71-bf69-597c-a242-fd3ece7b91b4/multiple-rce-vulnerabilities-in-sante-pacs-server-4-1-0 > Four vulnerabilities in Sante PACS Server 4.1.0 enable unauthenticated remote code execution; no active exploitation reported. MS-ISAC has published an advisory on multiple vulnerabilities affecting Sante PACS Server version 4.1.0. The most critical issue is a stack-based buffer overflow (CVE-2025-2263) in the login handler where OpenSSL's EVP_DecryptUpdate function is called with a fixed 0x80-byte stack buffer. An unauthenticated attacker can supply an oversized encrypted username or password to trigger the overflow and achieve remote code execution in the system context. A second critical flaw (CVE-2025-2264) is a path-traversal vulnerability allowing unauthenticated remote download of arbitrary files from the system disk. Two additional lower-severity vulnerabilities are documented: CVE-2025-2265, a password storage flaw where truncation of SHA1 hashes containing zero bytes weakens credential protection in the SQLite HTTP.db database, and CVE-2025-2284, a denial-of-service condition in the GetWebLoginCredentials function. The advisory reports no current in-the-wild exploitation. Successful exploitation of the critical flaws grants an attacker the ability to install programs, view, modify, or delete data depending on system privileges. The vendor Santesoft has released patches, and immediate deployment after testing is strongly recommended for all systems running the affected version. ## Mentioned in this report - Vulnerabilities: CVE-2025-2263, CVE-2025-2264 (weaponized), CVE-2025-2265, CVE-2025-2284 ## Detection guidance (public sample) ### Sante PACS Server Process Spawning Shell or LOLBin ATT&CK: T1190 A Sante PACS Server process spawning a command interpreter or common LOLBin, a likely sign of post-exploitation after the login-handler stack overflow (CVE-2025-2263). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Sante PACS Server Process Spawning Shell or LOLBin description: Detects a Sante PACS Server process spawning a command interpreter or common living-off-the-land binary. A DICOM/PACS web service has no normal reason to start these, so it suggests code execution after exploitation of the unauthenticated login-handler stack overflow (CVE-2025-2263). The parent match is on the product name rather than a fixed install path. tags: - attack.initial-access - attack.t1190 - cve.2025-2263 logsource: category: process_creation product: windows detection: selection: ParentImage|contains: Sante Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \mshta.exe - \rundll32.exe - \regsvr32.exe - \certutil.exe - \bitsadmin.exe - \curl.exe - \whoami.exe - \net.exe - \net1.exe condition: selection falsepositives: - Administrators running vendor-supplied maintenance or backup scripts launched by the PACS service - Vendor installer or updater launched from a Sante-named parent process level: high id: 0ce09537-31f9-5c7d-8629-149d710536f6 status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026 ``` ### Path Traversal Request Targeting System Files on Web Server ATT&CK: T1190 Web requests with directory traversal sequences that reference sensitive system files or the PACS HTTP.db database, consistent with CVE-2025-2264 arbitrary file download. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Path Traversal Request Targeting System Files on Web Server description: Detects HTTP requests that contain directory traversal sequences together with references to sensitive Windows system files or the Sante PACS SQLite HTTP.db credential database. Matches the unauthenticated arbitrary file download behaviour of CVE-2024-2264 style path traversal flaws such as CVE-2025-2264. Review the response status and size to confirm whether the file was returned. tags: - attack.initial-access - attack.t1190 - cve.2025-2264 logsource: category: webserver detection: selection_traversal: - cs-uri-stem|contains: - ../ - ..\ - '%2e%2e' - ..%5c - ..%2f - cs-uri-query|contains: - ../ - ..\ - '%2e%2e' - ..%5c - ..%2f selection_target: - cs-uri-stem|contains: - win.ini - boot.ini - windows/system32 - windows\system32 - HTTP.db - /etc/passwd - cs-uri-query|contains: - win.ini - boot.ini - windows/system32 - windows\system32 - HTTP.db - /etc/passwd condition: selection_traversal and selection_target falsepositives: - Authorised vulnerability scanners probing for path traversal - Penetration tests against the PACS web interface level: high id: 34cf7c8e-0276-5317-8d21-cbef6bc20bd6 status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026 ``` ### Sante PACS Server Process Writing Executable or Script Files ATT&CK: T1190 A Sante PACS Server process creating executable or script files on disk, which may indicate payload staging after RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Sante PACS Server Process Writing Executable or Script Files description: Detects a Sante PACS Server process creating executable, DLL or script files. After exploiting the unauthenticated login overflow (CVE-2025-2263) an attacker running in the service context may drop payloads. The server normally writes only images, database and log files. tags: - attack.initial-access - attack.t1190 - cve.2025-2263 logsource: category: file_event product: windows detection: selection: Image|contains: Sante TargetFilename|endswith: - .exe - .dll - .ps1 - .bat - .cmd - .vbs - .js - .hta condition: selection falsepositives: - Vendor software updates or patch installation performed by the PACS service - Plugin or codec DLLs being installed by an administrator level: high id: 3e26e311-b51d-59ab-9af6-d639436791ec status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026 ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. Source reporting: https://www.cisecurity.org/advisory/ms-isac-cybersecurity-advisory---multiple-vulnerabilities-in-sante-pacs-server-could-allow-for-remote-code-execution---patch-now---tlp-clear_2025-026 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/29808f71-bf69-597c-a242-fd3ece7b91b4/multiple-rce-vulnerabilities-in-sante-pacs-server-4-1-0. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup