CVE-2026-41939: Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly
Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed the vulnerable finding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Care Everywhere Gatewayto a version that resolves this vulnerability.Fixed in 14.3.10 - Upgrade
Upgrade
WildFly management interface bundled in Care Everywhere Gatewayto a version that resolves this vulnerability.Fixed in 8.2.0.Final - Compensating control
Restrict network access to the WildFly management console on port 20990 so only trusted/admin hosts can reach it; block all other inbound access via firewall/ACL.
- Compensating control
If you cannot immediately upgrade, prevent unauthenticated use of the WildFly Deployments interface by blocking access to the management interface endpoints used for deployments (port 20990) from untrusted networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41939?
CVE-2026-41939 has a critical severity score of 9.8.
How do I fix CVE-2026-41939?
To mitigate CVE-2026-41939, it is essential to change the hard-coded credentials immediately and ensure that proper authentication measures are implemented.
What systems are affected by CVE-2026-41939?
CVE-2026-41939 affects Allscripts Care Everywhere Gateway version 14.3.10 and Red Hat WildFly 8.2.0.Final.
What kind of attack can exploit CVE-2026-41939?
CVE-2026-41939 can be exploited by unauthenticated remote attackers gaining administrative access through default credentials.
Is there a known workaround for CVE-2026-41939?
Currently, the recommended workaround for CVE-2026-41939 is to remove or disable the management interface if not in use and to implement firewall rules to restrict access.