CVE-2026-3041
CVE-2026-3041
CRITICAL
CVE ID
CVE-2026-3041
CVSS
9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Vendor
Epic Systems
Product
MyChart 10.4.x, 10.5.x
Affected
MyChart 10.4.x prior to 10.4.7; 10.5.x prior to 10.5.3
Discovered
2026-03-12
Published
2026-04-26
Patched
2026-04-25
Exploit
PoC public; active exploitation reported
Description
The SAML assertion processor in Epic MyChart deserializes signature reference elements before validating the signature, permitting an attacker to inject a crafted reference that resolves to executable code in the assertion-handling pipeline.
Healthcare impact
Patient portals are typically reachable from the public internet to support patient access. A pre-auth RCE here is functionally equivalent to a compromise of the underlying application server, with downstream access to scheduling, messaging, and in many deployments to the broader EHR via integrated connections.
References
-- END OF RECORD --