CVE-2026-32238 CRITICAL

CVE-2026-32238: OpenEMR has Remote Code Execution in backup functionality

Vendor Openemr
Product openemr
Weakness CWE-78
Published March 19, 2026
Last update March 20, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 20, 2026 Record updated