CVE-2018-19276: OpenMRS insecure XML deserialization allows unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, public exploit code and a 99.9th percentile EPSS probability make this an urgent patch target.

What it is

OpenMRS before 2.24.0 deserializes untrusted XML data from request bodies without adequate validation, exposing an insecure object deserialization flaw (CWE-502). Because the request is processed before authentication, a remote attacker can trigger it without credentials, and the CVSS 3.1 base score is 9.8 (critical).

Impact

An attacker can execute arbitrary commands on the OpenMRS server, gaining full control of the host and any data it processes. With C/I/A all rated High, confidentiality, integrity and availability of the platform are fully compromised.

Attack surface

Reachable over the network via a crafted XML request body sent to the OpenMRS application; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is required.

Exploitation

Public exploit code exists (Exploit-DB 46327 and Packet Storm advisories tagged Exploit), and EPSS is 0.98714 (99.9th percentile), indicating very high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.

What to do

• Upgrade OpenMRS to 2.24.0 or later, which the vendor advisory identifies as the fixed release.
• If immediate upgrade is not possible, restrict network access to the OpenMRS web interface to trusted hosts and place it behind an authenticating reverse proxy.
• Disable or block XML request bodies at the edge where the application does not require them, and reject unexpected content types.
• Monitor the vendor advisory thread for interim guidance and apply any supplied hotfixes.
• Run the OpenMRS service with least privilege and isolate it from sensitive internal networks to limit post-exploitation reach.

Detection

• Inspect web and application logs for POST requests with XML bodies to OpenMRS endpoints, especially from unexpected source IPs.
• Alert on outbound connections or child processes spawned by the OpenMRS Java process, which may indicate command execution.
• Use the public Exploit-DB and Packet Storm proof-of-concept payloads to build IDS/IPS signatures for the deserialization request pattern.
• Baseline normal OpenMRS request content types and flag XML submissions that deviate from expected usage.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.