{"id":"CVE-2026-16305","aliases":["EUVD-2026-115613","GHSA-6wg9-8g76-mrm8"],"status":"published","title":"CVE-2026-16305","description":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00182,"percentile":0.07885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-276","CWE-732"],"published":"2026-11-02T20:13:26Z","modified":"2026-11-06T18:26:15Z","products":[{"vendor":"avaya","product":"system manager"},{"vendor":"infinitt healthcare","product":"system manager"}],"references":[{"url":"https://www.infinittna.com/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16305"},{"url":"https://www.infinittna.com"},{"url":"https://github.com/advisories/GHSA-6wg9-8g76-mrm8"}],"sources":{"cve":[{"id":"CVE-2026-16305","title":"CVE-2026-16305","description":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","status":"published","published":"2026-11-02T20:13:26.876Z","modified":"2026-11-06T18:26:15.534Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-732","CWE-276","CWE-269"],"updated_at":"2026-11-06T19:59:19.701997Z"}],"euvd":[{"id":"EUVD-2026-115613","description":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","status":"published","published":"2026-11-02T20:13:26Z","modified":"2026-11-06T18:26:15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"ghsa":[{"id":"GHSA-6wg9-8g76-mrm8","title":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co....","description":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","status":"published","published":"2026-11-02T21:32:05Z","modified":"2026-11-06T21:32:13Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-06T21:34:16.869182Z"}],"nvd":[{"id":"CVE-2026-16305","description":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","status":"published","published":"2026-11-02T21:17:30.617Z","modified":"2026-11-06T19:17:45.63Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269","CWE-276","CWE-732"],"updated_at":"2026-11-06T22:02:16.310898Z"}]}}