AI finds 38 vulnerabilities in the largest open-source EMR software

AISLE's AI analyzer reviewed the OpenEMR codebase in Q1 2026 and found 38 CVEs. That figure accounted for more than half of the OpenEMR security advisories published on GitHub during the same period.

OpenEMR is a large open-source EMR used by more than 100,000 healthcare providers and more than 200 million patients, and OpenEMR 8.0, released in February 2026, also received U.S. ONC certification. Compared with Project Insecurity's disclosure of 23 vulnerabilities in 2018, AI-based analysis found far more issues, much faster.

Notable issues included the following.

• CVE-2026-24908: The _sort parameter in the Patient REST API was appended directly to the SQL ORDER BY clause, allowing SQL injection.
• In the Immunization module's handling of patient_id, the value was also inserted directly into a SQL WHERE clause, which could lead to data leakage and conditional RCE.
• CVE-2026-24487: FHIR CareTeam did not enforce patient-scope restrictions, exposing full care team data even with a patient-scoped token.

Exploitation potential included mass PHI leakage, full DB compromise, and in some cases file read/write and web shell upload. For each CVE, AISLE proposed fixes that leveraged the repository's existing abstractions and validation logic, and the OpenEMR maintainers applied them quickly. The core patches went into OpenEMR 8.0.0 on February 11, 2026, with the rest addressed in follow-up patches in March.

Afterward, in April 2026, AISLE PRO was integrated into the code review stage, expanding the system to catch new vulnerabilities before deployment.