External risk intelligence

OpenEMR Stored Cross-Site Scripting Vulnerability in CAMOS Content Viewing

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124463

OpenEMR is a web-based electronic medical records application designed for clinical environments. While it often operates within internal hospital or clinic networks, it is frequently deployed as a web-accessible application to support remote access, telehealth, or multi-site clinical operations, making public internet exposure a common and expected deployment pattern for this type of software.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in OpenEMR, a widely used electronic health records system. The issue allows authenticated users with specific permissions to inject malicious code that can execute within the application, potentially enabling unauthorized actions or data access. The primary concern is confirming if this specific technology is in use and understanding its potential exposure.

Stored malicious code can execute.
Important for protecting patient data privacy.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can begin by gaining authenticated access to OpenEMR, specifically with CAMOS privileges. They can then inject malicious HTML and script content into CAMOS entries via the `ajax_save.php` endpoint. This stored script will execute unencoded when a victim user views the entry through the `rx_print.php` script, allowing the attacker to perform actions or read data as that user.

Requires authenticated user with CAMOS access.
Saving malicious CAMOS content triggers the vulnerability.
Stored script execution can lead to data theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated users to execute arbitrary scripts within the browser of other users when specific content is viewed. This could enable unauthorized actions and data access as the victim user when supported by the advisory.

User data and system actions at risk.
Injecting scripts via CAMOS content.
Unauthorized actions and data reading.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Application owners are likely responsible for OpenEMR, with support from infrastructure or platform teams for underlying systems. The first practical move is to identify all OpenEMR instances, confirm their reachability and business criticality, and then engage the accountable owner to plan remediation.

Identify OpenEMR instances and owners.
Verify instance reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenEMR?

OpenEMR is an open-source, web-based electronic health records and medical practice management application. Clinical environments utilize it to manage patient data, prescriptions, and administrative workflows. It is often hosted on servers to support telehealth and multi-site clinical operations.

What does CVE-2026-124463 mean by stored cross-site scripting?

This vulnerability, classified as CWE-79, occurs when an application accepts untrusted data and stores it without proper validation. In this case, an attacker saves malicious scripts into the system. These scripts later execute automatically in another user's browser, allowing the attacker to perform unauthorized actions as that victim.

How is this vulnerability triggered?

The issue requires an attacker to have valid credentials with access to the CAMOS module. They inject malicious content through the ajax_save.php script. The payload remains dormant until a victim views the entry using the rx_print.php script; if the user views the content through different, properly encoded branches, the execution is avoided.

Is my OpenEMR instance at risk?

Halo Surface Signal indicates that while OpenEMR is often used internally, it is frequently configured for public web access to support remote clinical needs. If your instance is reachable via the internet, it faces a higher profile for external interaction compared to strictly isolated, internal-only deployments.

Do I need to update my software?

Start by identifying all deployed instances and verifying their version numbers, as the flaw affects versions prior to 8.3.0. Once you confirm the scope, work with the team responsible for system maintenance to evaluate the current configuration and prioritize moving to a supported, patched release.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.