CVE-2026-32127
Published: 11 March 2026
Summary
CVE-2026-32127 is a high-severity SQL Injection (CWE-89) vulnerability in Open-Emr Openemr. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32127 is a SQL injection vulnerability (CWE-89) affecting OpenEMR, a free and open source electronic health records and medical practice management application. The flaw resides in the ajax graphs library due to insufficient input validation and impacts all versions prior to 8.0.0.1. Published on 2026-03-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers can exploit this vulnerability remotely with low complexity and without requiring user interaction. Exploitation enables arbitrary SQL query execution, potentially leading to high-impact confidentiality, integrity, and availability compromises, such as unauthorized data access, modification, or deletion within the application's database.
The vulnerability is addressed in OpenEMR version 8.0.0.1. Additional details on the issue and remediation are available in the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11401
Vulnerability details
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due…
more
to insufficient input validation in the ajax graphs library. This vulnerability is fixed in 8.0.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (OpenEMR) directly enables T1190 exploitation for initial access and arbitrary DB queries map to T1213.006 for data collection from databases.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE's root cause of insufficient input validation in the ajax graphs library by enforcing comprehensive input sanitization to prevent SQL injection.
Mandates timely identification, reporting, and patching of the specific SQL injection flaw fixed in OpenEMR 8.0.0.1.
Requires vulnerability scanning that would identify SQL injection flaws like CVE-2026-32127 for prioritized remediation.