CVE-2026-6903

CVE-2026-6903 affects the LabOne Web Server component, which provides the user interface for Zurich Instruments LabOne software. The vulnerability stems from insufficient input validation in file access functionality combined with inadequate cross-origin request restrictions. An unauthenticated remote attacker could exploit these flaws to read arbitrary files accessible to the operating system user running LabOne, either directly or by tricking a victim into visiting a malicious website. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it easily accessible to remote adversaries. The attack has high confidentiality impact as sensitive files could be disclosed, though integrity and availability are not affected. The vulnerability is only exploitable when the LabOne Web Server is actively running; users relying solely on LabOne APIs are not at risk. Currently, there is no evidence of active exploitation, with the vulnerability absent from the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00025 indicates very low probability of exploitation in the wild relative to other CVEs. However, the moderate FAUCET Risk Score of 48.0/100 and the straightforward nature of the attack suggest organizations running the LabOne Web Server should prioritize patching once updates become available.