1 Executive Summary

• CVSS: 9.1 (v3.1) / 9.4 (v4.0)
• ATTENTION: Exploitable remotely.
• Patient safety: Patient safety is not affected
• Vendor: B. Braun Melsungen AG
• Equipment: OnlineSuite^plus
• Vulnerabilities: Privilege Escalation 
  
  

2 Risk evaluation

Successful exploitation of this vulnerability may allow an attacker to escalate privileges, download and upload arbitrary files and change settings.

Note that all listed vulnerabilities are in the server-side software that is separated from the infusion pumps. Safety of patients or users is not affected by these vulnerabilities. 

B. Braun has received no reports of exploitation or incidents associated with these vulnerabilities in an actual use environment.
 

3 Technical Details

3.1 Affected Products

The following versions of B. Braun products are affected:

• OnlineSuite^plus Platform Administration version 3.0.0 (earlier versions are not affected). The software is only affected if a specific parameter was changed by the administrator (see below); under the default settings, the software is not vulnerable.

Other solutions of B. Braun are not affected.

3.2 Vulnerability Overview

3.2.1 Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

B. Braun OnlineSuite^plus uses the 3^rd-party package ‘Keycloak’. This 3^rd-party package has the known vulnerability CVE-2026-18963. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.

_{A CVSS v3.1 base score of 9.1 has been assigned (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). A CVSS v4.0 base score of 9.4 has been assigned (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N).}

3.3 Background

CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health

COUNTRIES/AREAS DEPLOYED: Worldwide

COMPANY HEADQUARTERS LOCATION: Germany

3.4 Researcher

Internal product surveillance discovered this 3^rd-party vulnerability to affect a B. Braun solution.

4 Mitigations

Exploitation of the vulnerability is only possible if the “Forgot Password” field was actively activated in the configuration by an administrator. In the default configuration, the field is deactivated. B. Braun recommends to immediately deactivate the field. If the field had been enabled in the past, B. Braun recommends to force a password change for all users. Please follow instructions in Field Service Information FSI 14/2026.

As a general security measure, B. Braun recommends protecting the network with appropriate mechanisms:

Ensure the medical devices are not accessible directly from the internet. Use a firewall and isolate the medical devices from the business network.

Restrict the user access to the server to the minimum required users. Operate the OnlineSuite^plus on a separate server that does not provide other services/applications and has no access to other sensitive data.

5 Contact and further information

Please contact our global product security team at productsecurity@bbraun.com if you have any further questions, require detailed technical information, or have any other support issue concerning the security of our products and services.

If you are a B. Braun customer and need support in mitigating the abovementioned vulnerabilities, please contact your local B. Braun representative.