CVE-2026-26462

High

Published: 18 May 2026

Published

18 May 2026

Modified

20 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0032 23.3th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26462 is a high-severity Expression Language Injection (CWE-917) vulnerability in Sourceforge (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-30773

Vulnerability details

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating…

system commands.

CWE(s): CWE-917

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Electron renderer misconfiguration (nodeIntegration enabled, contextIsolation disabled) directly enables arbitrary OS command execution from JavaScript in the client application, mapping to client-side exploitation (T1203) and JavaScript interpreter abuse (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1