Is CVE-2026-124469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124469 being exploited in the wild.

How severe is CVE-2026-124469?

Critical severity, with a CVSS score of 9.9, published 8 November 2026.

Is there a fix for CVE-2026-124469?

Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124469 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124469?

Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124469: OpenEMR SQL injection in Fee Sheet drug-inventory lookup

CVE-2026-124469 · Severity: critical · CVSS 9.9 · Published 2026-11-08

OpenEMR is an open-source electronic health record system that manages patient medical data and billing. A flaw in the Fee Sheet module allows low-privileged clinical staff to extract sensitive data including patient records and administrator passwords through a timed database query technique. An attacker can read the entire patient database and administrator account credentials, enabling account takeover and unauthorized access to all patient information.

Technologies: OpenEMR. Vendors: OpenEMR.

Quick answers

Is CVE-2026-124469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124469 being exploited in the wild.
How severe is CVE-2026-124469?: Critical severity, with a CVSS score of 9.9, published 8 November 2026.
Which products and versions are affected?: OpenEMR before 8.3.0.
Is there a fix for CVE-2026-124469?: Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124469 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124469?: Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.3.0

Technical details

An authenticated SQL injection vulnerability exists in DrugSalesService::sellDrug() where the prod[N][warehouse] POST parameter is unsanitized and interpolated directly into an ORDER BY clause. Low-privileged users with fee_sheet form access can exploit this via time-based blind SQL oracle using constant subqueries, bypassing the zero-row barrier imposed by SELL_FROM_ONE_WAREHOUSE mode. The attack extracts data from any table including users_secure (bcrypt password hashes), patient_data, and other sensitive records without requiring CSRF tokens.

Affected products

OpenEMR OpenEMR before 8.3.0

Timeline

2026-08-18: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.