OpenMRS RCE: Critical Vulnerability Allows Unrestricted Java Reflection

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-41258, has been identified in OpenMRS Core, an open-source electronic medical record system platform. According to the National Vulnerability Database, versions 2.7.0 through 2.7.8, and 2.8.0 through 2.8.5 are affected. The flaw stems from the ConceptReferenceRangeUtility.evaluateCriteria() method, which unsafely executes database-stored criteria strings as Apache Velocity templates without proper sandboxing.

This misconfiguration allows attackers to inject malicious Velocity template expressions into a concept’s reference range criteria field. A user with the Manage Concepts privilege can store this payload. Once stored, the malicious code executes automatically whenever a user or API call attempts to validate an observation against the affected concept. The Velocity context exposes sensitive objects like $patient (Person/Patient object), $obs (Obs object), and $fn (ConceptReferenceRangeUtility instance with full access to the OpenMRS service layer), enabling unrestricted Java reflection and full system compromise. The National Vulnerability Database assigns this a CVSS score of 9.1 (CRITICAL).

OpenMRS has addressed this vulnerability in versions 2.7.9 and 2.8.6. Organizations leveraging OpenMRS Core must prioritize patching to these versions immediately. Given the access to patient data and the broader service layer, the impact of exploitation is severe, ranging from data exfiltration to complete system takeover. Attackers will undoubtedly target this due to the high privilege access and data exposure it provides within healthcare environments.