# CVE-2026-14161: Advantech Hospital Queuing Management sensitive data exposure in API documentation

Source: https://junglewise.ai/threats/cve-2026-14161-advantech-hospital-queuing-management-sensitive-data-exposure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-14161 · Severity: high · CVSS 7.5 · Published 2026-06-30

Advantech Hospital Queuing Management, a system used to manage patient flow and appointments in healthcare facilities, contains a security flaw that exposes internal technical documentation. An unauthorized person could access detailed API documentation by visiting a specific web address without needing a password. This information could be used by attackers to better understand the system's inner workings and plan more sophisticated attacks against the hospital's infrastructure.

Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-14161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14161 being exploited in the wild.

**How severe is CVE-2026-14161?** High severity, with a CVSS score of 7.5, published 30 June 2026.

**Which products and versions are affected?** Advantech Hospital Queuing Management (HQM) ISO before 1.2.13.

**Is there a fix for CVE-2026-14161?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14161 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-14161?** Check whether you run Advantech Hospital Queuing Management ISO. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Advantech Hospital Queuing Management (HQM) ISO versions prior to 1.2.13 suffer from an information disclosure vulnerability (CWE-200). The application fails to restrict access to internal API documentation, which is reachable via a specific, predictable URL. An unauthenticated remote attacker can access this documentation without any user interaction. This exposure provides attackers with detailed knowledge of the system's API endpoints and data structures, potentially facilitating further attacks such as those leveraging missing authentication in other components. The issue is resolved by updating the HQM ISO to version 1.2.13 or updating QueueHttp.dll to version 1.2.12.7.

## Affected products

- Advantech Hospital Queuing Management (HQM) ISO before 1.2.13

## Timeline

- 2026-06-30: advisory
- 2026-06-30: disclosed

## References

- [https://www.twcert.org.tw/en/cp-139-11012-63761-2.html](https://www.twcert.org.tw/en/cp-139-11012-63761-2.html)
- [https://www.twcert.org.tw/tw/cp-132-11011-999eb-1.html](https://www.twcert.org.tw/tw/cp-132-11011-999eb-1.html)