CVE-2026-0611: Spacelabs Healthcare Sentinel 10.5.x < 11.6.0 Unauthenticated RCE via .NET Remoting
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. Attackers can write ASPX webshells to the IIS wwwroot directory to achieve unauthenticated remote code execution on the system. Port 8989 is not exposed in a default Sentinel installation; exploitation requires that the .NET Remoting port has been explicitly made network-accessible through deliberate configuration or network policy changes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spacelabs Healthcare Sentinelto a version that resolves this vulnerability.Fixed in 11.6.0 - Compensating control
Ensure the deprecated .NET Remoting HTTP channel on port 8989 is not network-accessible. Since default Sentinel installations do not expose port 8989, reverse any deliberate configuration or network policy changes that made the .NET Remoting port reachable from the network.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0611?
The severity of CVE-2026-0611 is critical with a CVSS score of 9.8.
How do I fix CVE-2026-0611?
To fix CVE-2026-0611, upgrade to Spacelabs Healthcare Sentinel version 11.6.0 or later.
What type of vulnerability is CVE-2026-0611?
CVE-2026-0611 is an unauthenticated remote code execution vulnerability.
What versions are affected by CVE-2026-0611?
CVE-2026-0611 affects Spacelabs Healthcare Sentinel versions 10.5.x and 11.x.x before 11.6.0.
How does CVE-2026-0611 impact Spacelabs Healthcare Sentinel?
CVE-2026-0611 allows attackers to perform arbitrary file read and write operations through a deprecated .NET Remoting HTTP channel.