A critical hard-coded credentials flaw (CVSS 9.8) in Care Everywhere Gateway 14.3.10 reportedly lets unauthenticated remote attackers log into a bundled WildFly management console and deploy a malicious WAR file for remote code execution.
What Is It
Care Everywhere Gateway 14.3.10 ships with a bundled WildFly 8.2.0.Final management interface protected by default credentials that, according to the advisory, are identical across installations. Because those credentials are hard-coded, any remote attacker able to reach the management console would likely be able to authenticate as an administrator without prior access.
From there, the reported attack path is short: authenticate to the exposed WildFly management console on port 20990, then upload and deploy a malicious Web Application Archive (WAR) through the Deployments interface. Per the researcher write-up, this is expected to yield remote code execution in the context of the Windows machine account, though the exact privilege context will depend on how the service is installed and configured in a given environment.
The issue is tracked as CWE-1392 (Use of Default Credentials) and was disclosed via VulnCheck.
Why It Matters
The base score is 9.8 (CRITICAL) with the metric string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. Note that those metrics are CVSS 3.1 syntax (S:U, PR:N), while the published record prefixes the string with CVSS:4.0/; the 9.8 score and this vector should be read as CVSS 3.1. A separate CVSS 4.0 score of 9.3 (CRITICAL) is also assigned, and its 4.0 vector is not reproduced in the record reviewed here.
If the advisory's description holds, there is no authentication barrier and no exploit chain to assemble. Shared static credentials suggest that a single working login would apply broadly across deployments of the affected version, and code execution as the Windows machine account would provide a foothold with domain-visible identity.
No CISA KEV entry accompanies this record, so active exploitation is not confirmed at time of writing.
What's Vulnerable
- Vendor: Care Everywhere LLC
- Product: Care Everywhere Gateway
- Affected version: 14.3.10 (default status: affected)
- Component: bundled WildFly 8.2.0.Final management interface, port 20990
Patch Status
Version 14.x.x was declared end-of-life in 2017. Per the advisory, future releases have addressed the vulnerable finding; meaning affected 14.x deployments are running unsupported software and would need to be upgraded off the EOL branch rather than patched in place. No specific fixed version or vendor remediation guidance is listed in the CVE record.
Sources
- NVD, CVE-2026-41939: https://nvd.nist.gov/vuln/detail/CVE-2026-41939
- VulnCheck Advisory; Care Everywhere Gateway Hard-Coded Credentials RCE via WildFly: https://www.vulncheck.com/advisories/care-everywhere-gateway-hard-coded-credentials-rce-via-wildfly
- Researcher gist (VAMorales): https://gist.github.com/VAMorales/95874f23e27e17362b87133013834c0a
- Unverified product page (intuvie.com; domain does not match the CVE-listed vendor "Care Everywhere LLC"; relationship to the affected product is unconfirmed): https://www.intuvie.com/products-overview