LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A bundled message broker shipped with guest:guest still enabled

MedDevice Cyber Staff · May 29 · 2 min read · Via Roche Diagnostics

Roche disclosed CVE-2026-9844 in navify Digital Pathology 2.0.0 through 2.4.1, base score 8.8. The bundled RabbitMQ management interface ships with the default guest and guest credentials unless an operator changes them.

RabbitMQ ships guest:guest as a local-only convenience. Expose it on the network without changing it and you have handed over the message bus, and the maker owns that, not the customer. If you bundle a broker, a database or a runtime with a known default, disabling or rotating it is part of your product. Change every default credential before you ship, then verify the next release did not quietly reintroduce it.

Remediation Desk

The bundled RabbitMQ management interface in navify Digital Pathology shipped usable with default guest credentials, exposed in CVE-2026-9844. Apply the Roche fix, then change or disable the default account and make sure the broker is not reachable from the general network.

Apply the vendor advisory. Follow the Roche product security advisory for CVE-2026-9844 to the fixed configuration.
Kill the default account. Disable or rotate the RabbitMQ guest credential; no bundled component should ship with a usable default login.
Segment the broker. Restrict the management interface to the hosts that need it, off the flat clinical network.

Sources

Roche Diagnostics ↗

Questions & Answers

What is CVE-2026-9844 in Roche navify Digital Pathology?

The product bundled a RabbitMQ message broker whose management interface kept the default guest account enabled unless it was changed during setup, which gives an attacker a ready-made login.

Is this a Roche bug or a RabbitMQ bug?

It is a packaging problem. RabbitMQ ships with guest:guest by design for local use. The issue is that navify shipped it in a state where those defaults could stay live.

What is the fix?

Follow Roche's advisory to disable or re-credential the guest account and lock the management interface to trusted hosts. Check any other product in your fleet that embeds a broker for the same default.

← Back to Vulnerabilities