OpenEMR MFA bypass and an Excel RCE that only needs one click
A stolen password plus CVE-2026-67611 (CVSS 8.1) completely skips MFA in OpenEMR. CVE-2026-62870 (CVSS 8.8) is a use-after-free in Excel that gives attackers code execution when a user opens a malicious spreadsheet. Also: two Edge bugs and a GIMP heap overflow pair.
Nothing's burning, but two of today's five patches deserve your attention before lunch. OpenEMR has an MFA bypass (CVE-2026-67611, CVSS 8.1) that lets anyone with stolen creds skip second-factor entirely by registering a rogue OAuth2 client. Right behind it, a use-after-free in Excel (CVE-2026-62870, CVSS 8.8) turns a malicious spreadsheet into full code execution. Neither is exploited in the wild yet, so you've got a window to act.
Today's CVEs
Sorted by urgencyCVE-2026-67611
NVDAn attacker who already has valid credentials (stolen, phished, or leaked) can completely skip multi-factor authentication in OpenEMR by registering their own OAuth2 client through an unauthenticated endpoint and trading the creds directly for an API token. MFA is supposed to be your safety net when passwords get compromised, and this bug removes it entirely. The attacker needs a valid username and password, but the whole point of MFA is that passwords alone shouldn't be enough.
- Affected estate
- Anyone running OpenEMR 8.2.0 or earlier, especially internet-facing instances with MFA enforced
- How to check
- Check your OpenEMR version in Administration > About. Verify whether the /oauth2/default/registration endpoint is publicly reachable.
- Included because
- MFA bypass; internet-facing; handles protected health data; CVSS 8.1
- Action
- Upgrade OpenEMR to a patched version. If unavailable, restrict or firewall the OAuth2 registration endpoint.
- Why it matters
- This lets anyone with stolen credentials bypass MFA and access patient health records via the API.
Evidence trail
- NVD: View source
CVE-2026-62870
NVDA use-after-free bug in Excel lets an attacker run code on your machine over the network. In practice, this means a malicious spreadsheet sent via email or shared link could give an attacker full control of the victim's session. The user has to open the file, but no other interaction is needed after that.
- Affected estate
- Anyone running Microsoft Office with Excel, including Microsoft 365 desktop installations
- How to check
- Run Excel > File > Account > About Excel and compare the build number to Microsoft's patch advisory. Alternatively, query installed Office builds via your endpoint management tool.
- Included because
- Network-exploitable; code execution; common product; CVSS 8.8
- Action
- Deploy the latest Office security update via Windows Update, WSUS, or your patch management tool.
- Why it matters
- A single malicious spreadsheet can give an attacker code execution on the victim's workstation.
Evidence trail
- NVD: View source
CVE-2026-66318
NVDAn origin validation error in Chromium-based Edge lets an attacker leak sensitive information over the network. This could allow a malicious site to read data it shouldn't have access to, potentially including tokens or cross-origin content. No exploitation in the wild reported yet.
- Affected estate
- Anyone deploying Microsoft Edge (Chromium-based) on desktops
- How to check
- Open edge://settings/help and compare the version to Microsoft's advisory. For fleet management, query the Edge version via Intune or your endpoint tool.
- Included because
- Network-exploitable; information disclosure; widely deployed browser; CVSS 8.1
- Action
- Push the latest Edge update through your browser update channel or management policy.
- Why it matters
- A malicious website could steal cross-origin data from an Edge user's session.
Evidence trail
- NVD: View source
CVE-2026-66310
NVDEdge for Android has a bug where an attacker can control file paths, letting them read files they shouldn't have access to on the local device. Exploitation is local, so the attacker either needs to be on the device or trick the user into triggering the path manipulation through another app or intent.
- Affected estate
- Mobile teams managing Microsoft Edge on Android devices via MDM
- How to check
- Check the Edge version on managed Android devices through your MDM console or Google Play managed app inventory.
- Included because
- Local exploitation; information disclosure; mobile browser; CVSS 7.7
- Action
- Push the latest Edge for Android update through your MDM or approve the update in managed Google Play.
- Why it matters
- An attacker could read local files on the device, potentially exposing cached credentials or session data.
Evidence trail
- NVD: View source
CVE-2026-42169
NVDTwo heap buffer overflow bugs in GIMP, one in the APNG loader and one in the DDS plugin, can be triggered by opening a crafted image file. An attacker who gets a user to open a malicious .apng or .dds file could potentially run code on that machine. This requires user interaction (opening the file), so it's a social engineering play more than a remote attack.
- Affected estate
- Anyone with GIMP installed, especially on creative or design workstations
- How to check
- Run `gimp --version` or check Help > About in the GIMP UI. Query your software inventory for GIMP installations across your fleet.
- Included because
- User interaction required; code execution via crafted file; CVSS 7.3
- Action
- Update GIMP to a patched version. If no fix is available yet, warn users not to open .apng or .dds files from untrusted sources.
- Why it matters
- A malicious image file could give an attacker code execution on a design workstation.
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
Read the rest of the field notes →