---
id: CVE-2026-16306
title: CVE-2026-16306
summary: >-
  Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare
  Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke
  unintended application functionality and potentially execute arbitrary code
  via a c…
severity: none
cwe:
  - CWE-470
  - CWE-94
vendor: INFINITT Healthcare
product: System Manager
affected:
  - system_manager >= 3.0.11.3 <= 3.0.11.5
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:38:11.487Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16306'
references:
  - url: 'https://www.infinittna.com/'
tags:
  - cve.org
epss: 0.00245
epssPercentile: 0.15835
ingestedAt: '2026-11-05T19:30:42.693Z'
---

## Overview

Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.

## Affected

- `system_manager >= 3.0.11.3 <= 3.0.11.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.