Security readout for executives and security teams
Plain-English summary
This issue affects certain Philips 1.5T and 3T MRI systems and may allow an unauthorized local actor to access a protected resource. The business risk is confidentiality exposure, not documented disruption or data alteration. Sources do not show active exploitation or a named fix in the supplied bundle.
Executive priority
Treat as a moderate medical-device security issue. Prioritize asset confirmation and vendor guidance, especially where MRI consoles or service interfaces are accessible to broad staff, contractors, or shared clinical areas.
Technical view
CVE-2021-26262 is an improper access control weakness, mapped to CWE-286, in Philips MRI 1.5T and MRI 3T software versions 5.3 through 5.8.1. CVSS 4.0 is 5.9 with local attack vector, low complexity, no privileges, no user interaction, and high vulnerable-system confidentiality impact.
Likely exposure
Likely exposure is limited to healthcare environments operating Philips MRI 1.5T or MRI 3T systems in the listed software range. Risk depends heavily on local access controls and operational access to the MRI environment.
Exploitation context
The source bundle states KEV is false and provides no evidence of active exploitation. The CVSS vector indicates local access is required, with no privileges or user interaction needed once attack requirements are met.
Researcher notes
The bundle has limited implementation detail and no exploit procedure or fix version. The affected array appears narrower than the narrative description, so validate scope against the CVE record, CISA advisory, and Philips guidance before final remediation decisions.
Mitigation direction
- Identify Philips MRI 1.5T and 3T systems and record software versions.
- Check Philips product security guidance for updates, patches, or compensating controls.
- Restrict local access to MRI workstations, consoles, and service interfaces.
- Review physical and operational access controls around affected MRI systems.
- Coordinate remediation through biomedical engineering and Philips support.
Validation and detection
- Confirm whether MRI software versions fall within 5.3 through 5.8.1.
- Compare asset inventory against the CISA ICS medical advisory.
- Verify only authorized staff can access MRI consoles and service paths.
- Review access logs or operational records for unauthorized local access indicators.
- Document any vendor-provided remediation status for affected systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-286: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-26262 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.9MediumVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.