CVE-2018-19276: Openmrs

Critical severity, CVSS 9.8. EPSS: 98.7% chance of exploitation in the next 30 days.

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

Affected products

• Openmrs Openmrs: from 1.12.0, before 1.12.1 (fixed in 1.12.1); from 2.0.0, before 2.0.8 (fixed in 2.0.8); from 2.1.0, before 2.1.4 (fixed in 2.1.4)

Published 2019-03-21. Last modified 2026-06-17.