CVE-2026-0611: Spacelabs Sentinel RCE Vulnerability

CVE-2026-0611 Overview

CVE-2026-0611 is an unauthenticated remote code execution vulnerability in Spacelabs Healthcare Sentinel, a diagnostic cardiology connectivity platform. The flaw resides in a deprecated .NET Remoting HTTP channel exposed on TCP port 8989. Attackers who can reach this port can supply valid .NET Uniform Resource Identifier (URI) endpoints to read and write arbitrary files on the host. The typical exploitation path writes an ASPX webshell into the Internet Information Services (IIS) wwwroot directory, granting code execution under the IIS worker process. Affected releases include Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0. Port 8989 is not exposed in default installations, so exploitation requires that an administrator or network policy has made the Remoting endpoint reachable.

Critical Impact
Unauthenticated network attackers can write ASPX webshells to IIS and execute arbitrary code on Spacelabs Sentinel cardiology servers when port 8989 is reachable.

Affected Products

Spacelabs Healthcare Sentinel 10.5.x and later 10.x releases
Spacelabs Healthcare Sentinel 11.x.x prior to 11.6.0
Sentinel deployments where .NET Remoting port 8989 has been exposed by configuration or network policy

Discovery Timeline

2026-06-02 - CVE-2026-0611 published to the National Vulnerability Database (NVD)
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-0611

Vulnerability Analysis

The vulnerability stems from missing authentication [CWE-306] on a .NET Remoting HTTP channel that Spacelabs Sentinel binds to TCP port 8989. .NET Remoting is a legacy inter-process communication framework that Microsoft deprecated due to its history of unsafe object deserialization and trust assumptions. The Sentinel implementation accepts remote calls to file-handling endpoints without verifying caller identity. An attacker who reaches the port can invoke methods that read or write arbitrary files on the underlying Windows host.

The practical impact is full system compromise. Sentinel runs alongside an IIS web server, and the attacker writes an ASPX file into the wwwroot directory. Requesting that file through IIS executes attacker-supplied code in the context of the web application pool. From there, adversaries can pivot to clinical data stores, harvest credentials, or move laterally within the hospital network.

Root Cause

The root cause is the exposure of an unauthenticated .NET Remoting service that supports file read and write operations through addressable URI endpoints. .NET Remoting channels do not enforce authentication by default, and the Sentinel service does not impose its own access control over the exposed methods. Combined with the colocated IIS instance, arbitrary file write becomes a direct path to remote code execution.

Attack Vector

The attack vector is network-based and requires no credentials or user interaction. The attacker sends crafted .NET Remoting requests to port 8989, supplies a valid Remoting URI for the file-write method, and places an ASPX payload at a known IIS-served path such as C:\inetpub\wwwroot\. The attacker then issues an HTTP request to the dropped webshell to invoke commands. Exploitation requires that port 8989 be reachable, which depends on deliberate firewall, routing, or installation choices made by the operator.

No verified public exploit code is available at the time of writing. Refer to the VulnCheck Advisory: Sentinel RCE and the Spacelabs Security Advisory for Sentinel for vendor technical details.

Detection Methods for CVE-2026-0611

Indicators of Compromise

Unexpected ASPX, ASHX, or ASMX files appearing in C:\inetpub\wwwroot\ or subdirectories on Sentinel hosts
Inbound TCP connections to port 8989 from hosts other than authorized Sentinel clients
IIS access logs showing requests to recently created ASPX files followed by command-style query parameters
w3wp.exe spawning child processes such as cmd.exe, powershell.exe, whoami.exe, or net.exe

Detection Strategies

Hunt for child processes of w3wp.exe on Sentinel servers and alert on shell or reconnaissance binaries
Monitor file creation events under IIS web roots and compare against an authorized baseline
Inspect network flow data for any traffic to port 8989 on Sentinel hosts and validate the source
Review .NET Remoting HTTP traffic for SOAP-style requests targeting file read or write method names

Monitoring Recommendations

Forward IIS, Windows Security, and Sysmon logs from Sentinel servers to a centralized SIEM for retention and correlation
Enable Sysmon Event IDs 1 (Process Create), 3 (Network Connect), and 11 (File Create) on Sentinel hosts
Track changes to the IIS web root with file integrity monitoring and alert on writes by non-administrative accounts
Audit firewall rules quarterly to confirm port 8989 remains restricted to required management subnets

How to Mitigate CVE-2026-0611

Immediate Actions Required

Upgrade Spacelabs Healthcare Sentinel to version 11.6.0 or later as published in the vendor advisory
Block inbound traffic to TCP port 8989 at the host firewall and at network perimeter devices serving the Sentinel segment
Inventory all Sentinel hosts and confirm whether port 8989 is currently network-accessible
Inspect IIS wwwroot directories on Sentinel servers for unauthorized ASPX files and remove any that are found

Patch Information

Spacelabs Healthcare has released Sentinel 11.6.0, which remediates the .NET Remoting exposure. Operators on the 10.5.x branch should consult Spacelabs for an upgrade path. The vendor advisory is published as Spacelabs Security Advisory for Sentinel. Additional context is available in the VulnCheck Advisory: Sentinel RCE and the Spacelabs Sentinel Product Overview.

Workarounds

Restrict TCP port 8989 to localhost or to a narrowly scoped management subnet using Windows Firewall or network access control lists
Place Sentinel servers in a dedicated VLAN that denies all unsolicited inbound traffic from clinical user networks
Disable any custom configuration that previously exposed the .NET Remoting channel beyond loopback
Apply application allow-listing on Sentinel hosts to prevent execution of unexpected binaries spawned by w3wp.exe

bash

# Example: Block inbound access to .NET Remoting port 8989 on a Sentinel host
netsh advfirewall firewall add rule ^
    name="Block Sentinel .NET Remoting 8989" ^
    dir=in ^
    action=block ^
    protocol=TCP ^
    localport=8989