Is CVE-2026-6903 actively exploited?

No active exploitation of CVE-2026-6903 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-6903 be exploited remotely?

Yes. CVE-2026-6903 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-6903?

CVE-2026-6903 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-6903

HIGH

CVE-2026-6903

CWE-22Published: April 23, 2026· Updated: Apr 24, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:6.9th

Official Description

The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are accessible to the operating system user running the LabOne software.

Additionally, the Web Server does not sufficiently restrict cross-origin requests, which could allow a remote attacker to trigger file access from a victim's browser by directing the victim to a malicious website.

The vulnerability is only exploitable when the LabOne Web Server is running. Installations using only the LabOne APIs without starting the Web Server are not exposed.

NVD Source

Technical Analysis

CVE-2026-6903 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.