This vulnerability (CVE-2026-9844) affects Roche Diagnostics navify Digital Pathology software, specifically versions from 2.0.0 up to but not including 2.4.1. It arises from the use of default usernames and passwords in the RabbitMQ Management interface modules, classified under CWE-1392 (Use of Default Credentials). The issue allows an unauthenticated attacker to gain unauthorized access due to weak credential management. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on user action.

The vulnerability allows an attacker to access the RabbitMQ Management interface using default credentials without authentication. This can lead to unauthorized access to sensitive system components, potentially compromising confidentiality and integrity of the affected system. The CVSS score of 8.8 reflects a high impact with network attack vector and no required privileges or user interaction. No known exploits have been reported in the wild so far.

No official patch or remediation guidance has been published by Roche Diagnostics as of now. Since the product is not cloud-hosted, users should immediately verify and change any default credentials in the RabbitMQ Management interface to strong, unique passwords to reduce risk. Monitor vendor communications for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.