External risk intelligence

INFINITT PACS `imodular://` Handler Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16306

The vulnerability exists in a custom URI handler (imodular://) associated with a specific medical imaging software (PACS) client application. While network-reachable if the application is installed on an endpoint, these systems are typically deployed within isolated clinical networks or internal hospital environments and are not intended for direct exposure to the public internet.

Code Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a specific medical imaging software component that could allow an unauthenticated remote attacker to execute arbitrary code. This issue arises from how the software handles custom web addresses, potentially enabling malicious actions if exploited. The primary concern is to confirm if this specific technology is in use within our organization's environment.

A flaw lets attackers run unauthorized code remotely.
Key risk: Unauthenticated remote code execution possible.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted link, disguised as a legitimate web link, to an unsuspecting user. If the user clicks this link, it would cause the `imodular://` URI handler to launch the vulnerable application. The handler would then process the malicious command and arguments embedded within the link, potentially leading to the execution of arbitrary code on the user's system.

No authentication required.
Malicious link trigger.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on a system running INFINITT PACS by tricking a user into clicking a crafted `imodular:// URI`. When supported, this could lead to the invocation of unintended application functionality or the execution of malicious commands with the privileges of the application.

System commands could be executed.
Via a crafted URI link.
Unintended application functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a specialized medical imaging application's URI handler necessitates immediate attention from teams responsible for the application, its supporting infrastructure, and endpoint security. The first actionable step is to locate all instances of the affected INFINITT PACS, determine their network exposure and business criticality, and identify the designated owner for remediation planning.

Application owners and infrastructure teams.
Verify instances and network exposure.
Plan remediation based on criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is INFINITT PACS?

INFINITT PACS is a medical imaging software solution used by healthcare organizations to manage, store, and view diagnostic images like X-rays and MRIs. The IModular.exe component specifically handles the application's interface and communication, often allowing the software to launch or interact with other tools via custom web-based commands.

What does CWE-94 mean for CVE-2026-16306?

CWE-94 refers to Improper Control of Generation of Code. In the context of this CVE, it means the software does not properly filter the commands sent to it. An attacker can use the imodular:// URI scheme to feed the application malicious instructions that it mistakenly executes as if they were legitimate program functions, leading to unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers this flaw by crafting a malicious imodular:// URI and tricking a user into clicking it. It is important to note that simply having the software installed is not enough; the attacker needs the user to interact with the specially formatted link. If the link is never opened by a user, the vulnerable code path in the URI handler is not invoked.

Is my system at risk?

According to Halo Surface Signal, this software is generally deployed within isolated clinical networks rather than the public internet. If your INFINITT PACS workstations are segmented from the public web and restricted to internal hospital traffic, the likelihood of an attacker successfully reaching the handler is significantly lower than for a standard internet-facing application.

When should I take action?

You should prioritize this if you manage infrastructure where INFINITT PACS is installed. Your first step is to create an inventory of all endpoints running this software. Once identified, work with the application owners to assess whether these systems have any unintended connections to broader networks and prepare a remediation plan to secure or update the affected URI handler.

References

www.infinittna.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.