CVE-2026-26142: Nuance PowerScribe Remote Code Execution Vulnerability

Synopsis

Deserialization of untrusted data in Nuance PowerScribe 360 (versions 4.0 through 4.0.7) allows a remote attacker with no authentication to execute arbitrary code on the server. The vulnerability is reachable over the network and requires no user interaction, making it trivially exploitable by anyone with access to the service endpoint. Successful exploitation gives the attacker full control over the affected host, including the ability to read, modify, or destroy data and disrupt service availability. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PowerScribe 360 service over the network; the vulnerability is exposed via a network-accessible endpoint (AV:N).

• AuthenticationNot required

  No account or credentials of any kind are needed; the malicious deserialization payload can be submitted by any unauthenticated caller (PR:N).

• Victim interactionNot required

  The attacker does not need a user to click a link, open a file, or take any other action; exploitation is fully server-side (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout knowledge, or environmental factors are required (AC:L).

Blast Radius

• A successful attacker gains remote code execution on the PowerScribe 360 server, enabling arbitrary command execution under the application's process identity.
• All data accessible to the server process, including radiology reports and stored credentials, can be read by the attacker (C:H).
• The attacker can modify or delete persisted data such as patient reports, configuration, and database records (I:H).
• The attacker can crash or otherwise disrupt the PowerScribe 360 service, making it unavailable to clinical users (A:H).