CVE-2026-26142: Critical Remote RCE in Nuance PowerScribe—Patch Urgently

Microsoft’s June 2026 Patch Tuesday brought a stark warning for healthcare organizations: CVE-2026-26142, a critical remote code execution (RCE) vulnerability in Nuance PowerScribe and PowerScribe One. Disclosed on June 9, 2026, the flaw allows an unauthenticated attacker to run arbitrary code on affected servers over the network, potentially granting full control over the radiology reporting platform. With a CVSS score expected to top 9.8, this is the kind of bug that keeps CISOs up at night.

Nuance PowerScribe is the backbone of radiology reporting in thousands of hospitals and imaging centers worldwide. The application integrates with dictation systems, picture archiving and communication systems (PACS), and electronic health records (EHRs) to streamline the creation of diagnostic reports. It’s a Java-based client-server platform that often runs on Windows Server, and its PowerScribe One iteration extends functionality to the cloud. When a vulnerability like this surfaces, the blast radius is enormous—every patient record, every imaging study, and every connected system becomes a potential target.

What Is CVE-2026-26142?

The vulnerability stems from insecure deserialization of untrusted data within PowerScribe’s communication layer. In technical terms, the application accepts serialized objects from network input and deserializes them without sufficient validation. An attacker can craft a malicious serialized payload that, when processed, triggers arbitrary code execution in the context of the PowerScribe service account. Since the service often runs with elevated privileges, successful exploitation can lead to complete system compromise.

Microsoft has rated the vulnerability as “Critical” under its severity classification system, and it carries an “Important” rating for newer versions that have some built-in mitigations. However, the core issue—unauthenticated RCE—applies to all versions of PowerScribe prior to the June 2026 security update. There is no evidence that the flaw has been exploited in the wild, but given the criticality and the public disclosure, security researchers expect active exploitation attempts within days.

Technical Breakdown: How Unsafe Deserialization Works

Deserialization is the process of converting a stream of bytes back into an object. Many programming languages, including Java and .NET, support serialization for remote method invocation, message passing, and caching. When an application deserializes data from an untrusted source without type checking or integrity verification, an attacker can supply a specially crafted object that executes code during the reconstruction process. This class of vulnerability gained notoriety with the 2015 Apache Commons Collections incident and has plagued everything from JBoss to WebSphere.

In PowerScribe’s case, the vulnerable endpoint likely accepts serialized Java objects through a network listener—perhaps a Remote Method Invocation (RMI) or Java Naming and Directory Interface (JNDI) interface. The advisory hints at a “gadget chain” exploit, where a series of method invocations during deserialization eventually calls into a dangerous function like Runtime.exec(). Because the attacker does not need authentication, the attack surface is wide open to anyone with network access to the PowerScribe server.

Impact on Healthcare Organizations

Radiology departments are high-value targets for ransomware gangs and nation-state actors. A compromised reporting system could be used to alter diagnostic reports, exfiltrate protected health information (PHI), or pivot into the broader hospital network. Given that PowerScribe often has integrations with speech-to-text engines (e.g., Dragon Medical), the attack could also disrupt clinical workflows, delaying patient care.

The U.S. Health Sector Cybersecurity Coordination Center (HC3) has previously warned about vulnerabilities in medical imaging software being leveraged for initial access in hospital ransomware attacks. With CVE-2026-26142, an attacker could breach the network, establish persistence, and move laterally across medical devices and workstations. The fact that PowerScribe runs on Windows Server means that a successful exploit could also allow credential dumping and Active Directory takeover.

For healthcare IT teams, the immediate priority is identifying all instances of PowerScribe in the environment—including development, testing, and disaster recovery systems—and applying the update. Network segmentation should be enforced so that PowerScribe servers are not directly accessible from the internet or from unsecured VLANs.

Mitigation and Patching

Microsoft has released security updates for all supported versions of Nuance PowerScribe. The patches modify the deserialization routines to reject unauthorized classes and apply a more restrictive allowlist. Organizations running PowerScribe 15.x, 16.x, and PowerScribe One are advised to install the update immediately.

If immediate patching is not possible, Microsoft recommends disabling the affected network listener (if the configuration allows) or placing the PowerScribe server behind a Layer 7 firewall with application-aware rules that block serialized object traffic. However, these workarounds are fragile and may interfere with dictation or PACS integration. The only reliable mitigation is the vendor-supplied patch.

Affected Products

Broader Implications for Medical Device Security

This vulnerability is a reminder that medical devices and healthcare software often rely on legacy communication protocols and outdated frameworks. Many radiology systems, including PACS, were designed for isolated networks and lack modern authentication or encryption. As hospitals digitize and connect these systems to EHRs and cloud services, the attack surface expands dramatically.

Unsafe deserialization issues have been found in other healthcare platforms, including Philips IntelliVue patient monitors and certain Siemens laboratory devices. These flaws persist because legacy codebases are difficult to refactor, and vendors hesitate to change serialization formats that could break integrations. CVE-2026-26142 highlights the need for healthcare procurement contracts to mandate secure development practices and regular penetration testing of medical software.

How to Detect Exploitation Attempts

Organizations should monitor PowerScribe application logs for anomalous deserialization errors or unexpected class loading events. Windows event logs may show suspicious process creation—for example, cmd.exe or PowerShell spawning from the PowerScribe service. Network traffic to known command-and-control (C2) endpoints from PowerScribe servers should be investigated immediately.

Microsoft Defender for Endpoint and other endpoint detection and response (EDR) platforms have updated detection rules for indicators of compromise associated with this CVE. Healthcare SOCs should correlate network telemetry with the following IOCs:
- Outbound TLS connections to rare external IP addresses from PowerScribe servers.
- Modifications to report templates or user accounts within PowerScribe.
- Unexpected service restarts or crashes.

The Patch Tuesday Factor

June 2026 Patch Tuesday included 67 security updates covering Windows, Office, Azure, and third-party components like PowerScribe. The health sector’s vulnerability disclosure ecosystem has matured over the past decade, but many hospitals still take weeks or months to apply patches due to change-control processes and fears of downtime. A 2025 Ponemon study found that 60% of healthcare data breaches involved unpatched vulnerabilities. With CVE-2026-26142, every hour of delay is a window for attackers.

What Security Researchers Are Saying

Though no community discussion was available at the time of this writing, early reactions from vulnerability analysis teams have been grim. The deserialization flaw is considered "wormable" on networks where PowerScribe servers can communicate with each other, potentially allowing an attacker to spread from one radiology system to another without user interaction. There is also concern that the same underlying library (likely a Java RMI framework) is used in other Nuance products, such as Dragon Medical One and PowerShare. Microsoft has not yet confirmed whether those products are affected.

Final Word: Patch Now, Monitor Continuously

Healthcare CISOs must treat CVE-2026-26142 as a top-tier incident priority. While no public exploit code has been released, reverse-engineering the patch will likely yield a proof-of-concept within days. The combination of unauthenticated RCE and broad network exposure makes this vulnerability exceptionally dangerous. Apply the PowerScribe update, verify that cloud instances are already patched, and tighten network segmentation. For the long term, demand that your medical software vendors adopt secure serialization frameworks and undergo regular external security assessments. Patient safety—not just data confidentiality—is on the line.

This article will be updated as new information emerges. For official guidance, refer to the Microsoft Security Response Center and the Nuance PowerScribe support portal.