CVE-2026-41939CWE-1392

Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly

Critical · published July 29, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed the vulnerable finding.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01092 · 65.1th percentile
Weakness
CWE-1392 · Use of Default Credentials
Published
2026-07-29T17:39Z
EPSS history
Timeline
  • 29 JUL 17:39Z
    Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly
    cvelistv5