Care Everywhere Gateway Hard-Coded WildFly Management Credentials RCE
First seen Jul 30, 2026 · Updated Jul 30, 2026 · CVSS 9.8
Care Everywhere Gateway 14.3.10 ships with a bundled WildFly 8.2.0.Final management console that uses hard-coded, identical credentials across all installations, exposing an administrative interface on port 20990 to unauthenticated attackers. Successful exploitation allows deployment of a malicious WAR file, resulting in remote code execution as the Windows machine account. The affected 14.x.x branch has been end-of-life since 2017 and no patch exists for this version line.
Technical Analysis
CVE-2026-41939 (CVSS 9.8) stems from static, non-randomized default credentials embedded in the WildFly 8.2.0.Final management console bundled with Care Everywhere Gateway 14.3.10. An attacker can reach the exposed management interface on TCP port 20990 without authentication bypass effort, since the credentials are identical across all deployments, then use the Deployments feature to upload a crafted Web Application Archive (WAR) file. Once deployed, the WAR executes arbitrary code with the privileges of the Windows machine account hosting the service, effectively granting full host compromise. Because the software is EOL and unsupported since 2017, no official patch is forthcoming, making network isolation and compensating controls the primary defense. Organizations that run AI agent orchestration, RAG pipelines, or automation tooling on the same Windows hosts or network segment as this healthcare interoperability gateway are at risk of lateral movement, credential theft (including API keys or service account tokens used by agents), and full agent-host compromise if this system is not isolated.
Affected Systems
Care Everywhere Gateway version 14.3.10 and other 14.x.x releases; bundled WildFly 8.2.0.Final management interface exposed on TCP port 20990; Windows Server hosts running the gateway service under a machine account
Indicators of Compromise
- Port 20990 exposed on internet-facing or internal healthcare interoperability hosts
- Unexpected WAR file deployments via WildFly Deployments interface
- Anomalous administrative logins to WildFly management console with default/known credential set
- Newly deployed .war files with unusual naming or timestamps in WildFly deployment directories
Remediation Steps
- 1
Upgrade off EOL version
Migrate from Care Everywhere Gateway 14.x.x to a currently supported release that does not bundle the vulnerable WildFly management interface or hard-coded credentials.
- 2
Restrict network access
Firewall off port 20990 from all untrusted networks and restrict access to the WildFly management interface to a dedicated management VLAN with strict allow-listing.
- 3
Rotate and randomize credentials
If upgrade is not immediately possible, manually change the default WildFly management credentials on every instance to unique, strong passwords.
- 4
Disable unused management interface
Disable or remove the WildFly management console entirely if it is not required for operational administration.
- 5
Monitor for exploitation
Deploy monitoring for WAR file deployments, unusual process execution under the machine account, and authentication attempts to the management interface.
- 6
Network segmentation for agent workloads
Ensure any AI agent, automation, or RAG infrastructure is segmented away from legacy healthcare interoperability systems to prevent lateral movement and credential exposure.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.