CVE-2026-23627
Published: 25 February 2026
Summary
CVE-2026-23627 is a high-severity SQL Injection (CWE-89) vulnerability in Open-Emr Openemr. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23627 is an SQL injection vulnerability (CWE-89) in the Immunization module of OpenEMR, a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 are affected, where user-supplied `patient_id` values are directly concatenated into SQL WHERE clauses without parameterization or escaping. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Any authenticated user can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows execution of arbitrary SQL queries, resulting in complete database compromise, exfiltration of protected health information (PHI), credential theft, and potential remote code execution.
OpenEMR version 8.0.0 addresses the issue with a patch. Mitigation involves upgrading to version 8.0.0 or later. Additional details are available in the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-x3hw-rwrg-v25h and the patching commit at https://github.com/openemr/openemr/commit/cbf4ea4345b14a6c8362201e30c74ffb0949cdb1.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8700
Vulnerability details
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database…
more
compromise, PHI exfiltration, credential theft, and potential remote code execution. The vulnerability exists because user-supplied `patient_id` values are directly concatenated into SQL WHERE clauses without parameterization or escaping. Version 8.0.0 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible web app (OpenEMR) directly enables remote exploitation for initial access (T1190) and arbitrary query execution against the backend database (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of user-supplied patient_id inputs before concatenation into SQL queries, preventing SQL injection exploitation.
Mandates monitoring for vulnerabilities like CVE-2026-23627 and timely application of patches such as OpenEMR 8.0.0 to remediate the flaw.
Provides vulnerability scanning to identify SQL injection flaws in modules like Immunization, enabling proactive remediation.