CVE-2026-0611: Spacelabs Healthcare Sentinel 10.5.x < 11.6.0 Unauthenticated RCE via .NET Remoting

Synopsis

This is an unauthenticated remote code execution vulnerability in Spacelabs Healthcare Sentinel versions 10.5.x through 11.x.x before 11.6.0. The flaw stems from a deprecated .NET Remoting HTTP channel exposed on port 8989, which accepts arbitrary .NET URI endpoints without any authentication check. An attacker who can reach that port can write ASPX webshells to the IIS web root and execute arbitrary code on the host. A patched-image rebuild at version 11.6.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach port 8989 over the network; this port is not exposed in a default Sentinel installation, so exploitation requires that it has been made network-accessible through deliberate configuration or a network policy change.

• AuthenticationNot required

  The .NET Remoting channel performs no authentication check, so any client that can connect to port 8989 can send malicious payloads without credentials.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  The exploit is reliable under normal conditions, though it requires that the attacker target a specific precondition (port 8989 being network-accessible), which slightly constrains but does not prevent a determined attacker.

Blast Radius

• Attacker reads arbitrary files from the host filesystem, including configuration files, credentials, and application secrets.
• Attacker writes arbitrary files to the IIS web root, enabling webshell deployment and persistent code execution under the IIS worker process identity.
• Attacker executes arbitrary commands on the host with the privileges of the IIS application pool account, which in many Windows deployments carries broad local privileges.
• Full confidentiality, integrity, and availability of the Sentinel application and its stored patient monitoring data are compromised.