Is CVE-2026-14162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14162 being exploited in the wild.

How severe is CVE-2026-14162?

Critical severity, with a CVSS score of 9.8, published 30 June 2026.

Which products and versions are affected?

Advantech Hospital Queuing Management (HQM) ISO before 1.2.13.

Is there a fix for CVE-2026-14162?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14162 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-14162?

Check whether you run Advantech Hospital Queuing Management (HQM) ISO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14162: Advantech Hospital Queuing Management missing authentication in API

CVE-2026-14162 · Severity: critical · CVSS 9.8 · Published 2026-06-30

Advantech Hospital Queuing Management, a system used to manage patient flow and appointments in healthcare facilities, contains a critical security flaw. An unauthorized person can remotely access the system's internal programming interfaces to steal sensitive hospital data or create their own administrator accounts. This could lead to a total takeover of the system, compromising patient privacy and disrupting hospital operations.

Vendors: Advantech.

Quick answers

Is CVE-2026-14162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14162 being exploited in the wild.
How severe is CVE-2026-14162?: Critical severity, with a CVSS score of 9.8, published 30 June 2026.
Which products and versions are affected?: Advantech Hospital Queuing Management (HQM) ISO before 1.2.13.
Is there a fix for CVE-2026-14162?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14162 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-14162?: Check whether you run Advantech Hospital Queuing Management (HQM) ISO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in Advantech Hospital Queuing Management (HQM) prior to version 1.2.13. The flaw resides in the system's API handling, where certain critical functions do not require identity verification. An unauthenticated remote attacker can exploit this by sending crafted requests to specific API endpoints to extract sensitive data or register new administrative users. The vulnerability is addressed by updating the HQM ISO to version 1.2.13 or later, or by specifically updating the QueueHttp.dll component to version 1.2.12.7 or later.

Affected products

Advantech Hospital Queuing Management (HQM) ISO before 1.2.13

Timeline

2026-06-30: disclosed
2026-06-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.