VulnerabilityDeferred

CVE-2026-42516

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access.

HIGH 7.1EPSS 0.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.

CVSS 4.0: 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.23% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: vdisclose@cert-in.org.in

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.