CVE-2026-0611 Details

A remote code execution vulnerability has been identified in Spacelabs Healthcare Sentinel versions 10.5.x and higher, as well as 11.x.x prior to 11.6.0. This vulnerability arises from an unauthenticated .NET Remoting HTTP channel exposed on port 8989, which allows attackers to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. Exploitation of this vulnerability enables attackers to write ASPX web shells to the IIS wwwroot directory, achieving unauthenticated remote code execution on the system. While port 8989 is not exposed by default in Sentinel installations, the vulnerability can be exploited if the .NET Remoting port has been deliberately made network-accessible through configuration or network policy changes.

Users are advised to update Sentinel Software to the latest version 11.6.2, which addresses the vulnerability. US customers can contact Spacelabs Technical Support to schedule the update. Canadian customers should reach out to Canada Technical Support, while international customers can contact Global Technical Support.