External risk intelligence

Spacelabs Sentinel Unauthenticated Remote Code Execution via .NET Remoting

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-0611

The vulnerable service uses a .NET Remoting port (8989) that is not exposed in a default installation. While network-reachable in some environments, public internet exposure is uncommon because it requires deliberate configuration or network policy changes to make the port accessible.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Spacelabs Healthcare Sentinel systems could allow unauthenticated attackers to execute arbitrary code remotely. This is possible through a specific, deprecated network channel that, if intentionally exposed, could permit attackers to read and write files, potentially leading to system compromise. The primary concern is to confirm if this specific port has been deliberately opened in your environment, as it is not exposed by default.

Unauthenticated remote code execution risk.
Only relevant if a specific port is exposed.
Confirm if the exposed port exists.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting a Sentinel system where the .NET Remoting HTTP channel on port 8989 has been made network-accessible. By sending specially crafted .NET URI requests to this channel, an unauthenticated attacker can leverage the deprecated feature to read and write files on the system. This capability can be used to deploy malicious files, such as ASPX webshells, into the IIS wwwroot directory, ultimately allowing for unauthenticated remote code execution.

Requires .NET Remoting port to be network-accessible.
Attacker sends malicious .NET URI requests.
Leads to unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When explicitly configured to be network-accessible, this vulnerability could allow unauthenticated attackers to read and write arbitrary files by exploiting a deprecated .NET Remoting channel, potentially enabling the deployment of malicious code.

System files and network configurations at risk.
Exposure via deliberate port 8989 access.
Risk of unauthenticated remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Spacelabs Healthcare Sentinel product's .NET Remoting vulnerability requires careful triage by teams managing the application and its underlying infrastructure. The first practical step is to identify all Sentinel instances, confirm if port 8989 is accessible externally, and then ascertain the business criticality and owner of each instance before planning remediation.

Identify application owners.
Verify port 8989 accessibility.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Spacelabs Healthcare Sentinel?

Spacelabs Healthcare Sentinel is a diagnostic cardiology connectivity platform used to manage clinical data and cardiac testing workflows. It integrates medical devices with hospital information systems to support patient care and clinical decision-making. The software relies on various internal communication channels to process this diagnostic data, some of which may include legacy components for compatibility with older network architectures.

What is the vulnerability in CVE-2026-0611?

This CVE involves a weakness classified as CWE-306, which relates to missing authentication for a critical function. Specifically, a deprecated .NET Remoting HTTP channel can be accessed without credentials. If reached, this channel permits an attacker to perform file operations, such as reading or writing files, which can then be used to run unauthorized code on the host system.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted .NET URI requests to the deprecated service listening on port 8989. Importantly, this bug is not triggered in a default Sentinel installation because this port is not active or reachable by design. It only becomes a viable path for exploitation if an administrator has manually opened this port through deliberate configuration changes or specific network policy updates.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal labels the likelihood of active risk as 'Unlikely' for most environments. Because the vulnerable port is closed by default, public internet exposure is uncommon. You should only be concerned if your internal network policies or manual configurations have explicitly made port 8989 network-accessible, which would deviate from the standard deployment of the software.

What is the first step to address this issue?

You should begin by identifying all deployed Sentinel instances within your environment. Verify whether port 8989 is currently accessible over the network for any of these systems. Once you have confirmed the status of these ports, determine the business criticality of the affected machines and coordinate with the application owners to plan appropriate security adjustments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.