Affected Systems

drEryk Gabinet software, all versions before 11.5.0. Affects the ticket reporting component with hard-coded API credentials that authenticate directly to the ticket system API.

Exploitation Status

No public PoC or active exploitation reported. Vulnerability disclosed through coordinated disclosure process with CERT Polska. Exploitation requires extracting hard-coded credentials from the application binary or configuration.

Business Impact

Attackers with access to the hard-coded credentials can bypass application controls and directly authenticate to the ticket system API. This enables unauthorized reading and modification of all tickets, potentially exposing sensitive patient/medical data and allowing manipulation of support records. Impact is limited to organizations using drEryk Gabinet software with the ticket reporting component enabled.

Urgency

🟡 Within a week

Recommended Actions

  • Upgrade drEryk Gabinet to version 11.5.0 or later immediately
  • Audit ticket system logs for unauthorized API access or suspicious ticket modifications prior to patching
  • If immediate patching is not possible, disable or restrict network access to the ticket reporting component
  • Rotate API credentials for the ticket system after upgrading to invalidate the hard-coded credentials
  • Review all tickets for unauthorized modifications or data exfiltration during the vulnerable period

---

# Geopolitical Context

Geopolitical Context

The disclosure of CVE-2026-17038 in drEryk Gabinet, a medical practice management software used in Poland, represents a routine coordinated vulnerability disclosure handled by CERT Polska. Hard-coded credential vulnerabilities are a common software security weakness that can enable unauthorized access to sensitive systems. In the healthcare sector, such flaws carry heightened risk due to the sensitivity of patient data and potential regulatory implications under frameworks like GDPR. The vulnerability was responsibly reported and coordinated through established disclosure processes, reflecting mature cybersecurity practices within Poland's national CERT infrastructure. No evidence suggests state-sponsored exploitation or targeting; this appears to be a standard software security issue affecting a commercial healthcare product.

State Actor Alignment

No state actor involvement is indicated. This is a coordinated vulnerability disclosure processed through CERT Polska's civilian cybersecurity infrastructure. The vulnerability was reported by an independent security researcher and follows standard responsible disclosure protocols. There are no sanctions implications or indicators of state-sponsored activity associated with this disclosure.

Business Impacty pro region

The vulnerability's impact is primarily localized to Poland's healthcare sector, where drEryk Gabinet software may be deployed in medical practices. For the broader European context, this disclosure underscores ongoing challenges in securing healthcare IT systems across the EU, particularly in ensuring secure software development practices among smaller vendors serving national markets. The incident may prompt regulatory scrutiny under the EU's NIS2 Directive and GDPR, given healthcare's status as critical infrastructure and the sensitivity of medical data. It also highlights the value of national CERT coordination capabilities in managing software vulnerabilities affecting domestic sectors. No cross-border implications are apparent beyond general lessons for healthcare cybersecurity practices.

Forecast

If medical practices have not yet upgraded to drEryk Gabinet version 11.5.0 or later, they remain vulnerable to unauthorized access to patient ticketing systems, which could result in data breaches and regulatory penalties. If threat actors become aware of the technical details now publicly disclosed, exploitation attempts targeting unpatched installations are likely to increase in the coming weeks. If Polish healthcare regulators or data protection authorities investigate, affected organizations may face compliance actions under GDPR. Broader sectoral impact is unlikely unless similar hard-coded credential practices are discovered in other healthcare software products, which could prompt wider security reviews across the European healthcare IT supply chain.