Cyber Posture

CVE-2026-33910

HighPublic PoC

Published: 25 March 2026

Published
25 March 2026
Modified
26 March 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0000 0.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33910 is a high-severity SQL Injection (CWE-89) vulnerability in Open-Emr Openemr. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires input validation mechanisms at entry points like the patient selection feature to prevent SQL injection exploitation due to insufficient validation.

prevent

Mandates timely identification, reporting, prioritization, and remediation of flaws, such as applying the OpenEMR 8.0.0.3 patch for this specific SQL injection vulnerability.

detect

Vulnerability scanning identifies SQL injection vulnerabilities like CVE-2026-33910 in OpenEMR prior to exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web app (OpenEMR) directly enables remote exploitation of the application (T1190); arbitrary SQL execution against backend DB directly facilitates collection from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability…

more

exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.

Deeper analysisAI

CVE-2026-33910 is a SQL injection vulnerability (CWE-89) affecting OpenEMR, a free and open source electronic health records and medical practice management application. The flaw resides in the patient selection feature due to insufficient input validation and impacts versions up to and including 8.0.0.2. Published on 2026-03-25, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Authenticated attackers with high privileges (PR:H) can exploit the vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary SQL query execution against the backend database.

Mitigation is available in OpenEMR version 8.0.0.3, which includes a patch addressing the input validation issue. Security practitioners should review the fixing commit at https://github.com/openemr/openemr/commit/73db3264aed253684532839380cae3b0a56c83d2, the release notes at https://github.com/openemr/openemr/releases/tag/v8_0_0_3, and the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-x32c-xj5g-7jx7 for implementation details.

Details

CWE(s)

Affected Products

open-emr
openemr
≤ 8.0.0.3

CVEs Like This One

CVE-2026-32127Same product: Open-Emr Openemr
CVE-2026-23627Same product: Open-Emr Openemr
CVE-2026-25746Same product: Open-Emr Openemr
CVE-2026-33917Same product: Open-Emr Openemr
CVE-2026-33914Same product: Open-Emr Openemr
CVE-2026-24908Same product: Open-Emr Openemr
CVE-2026-29187Same product: Open-Emr Openemr
CVE-2026-32123Same product: Open-Emr Openemr
CVE-2026-25927Same product: Open-Emr Openemr
CVE-2026-25164Same product: Open-Emr Openemr

References