INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 have critical vulnerabilities. These flaws allow attackers to execute arbitrary code on affected systems. One vulnerability, CVE-2026-16305, stems from an improperly protected update manifest. A local attacker can modify a file named execlist.txt due to insecure permissions. This modification allows arbitrary malicious commands to be executed with administrative privileges when an update is approved. The second vulnerability, CVE-2026-16306, is an unsafe command dispatch through the imodular:// URI scheme. A crafted link can trick IModular.exe into executing commands without proper verification. This could lead to code execution with the user's privileges, data access, or further network attacks. Exploitation could allow attackers to install software, access protected files, or disable security. Moreover, it could enable unauthorized outbound communication, potentially exposing sensitive data. INFINITT Healthcare has released fixed versions, 3.0.12.3 and 3.0.12.5, to address these issues. Users are advised to upgrade to these patched versions as soon as possible.