CVE-2023-43208

NextGen Healthcare's Mirth Connect suffered a critical deserialization vulnerability allowing unauthenticated remote code execution, linked to ransomware attacks.

The Mirth Connect platform, widely used in healthcare for EHR integration, contained a deserialization of untrusted data flaw enabling attackers to execute arbitrary code without authentication. This failure is critical for DIB organizations because it represents a severe supply-chain and software vulnerability that directly enables ransomware, leading to massive data breaches and operational disruption. Organizations must rigorously patch Mirth Connect and similar middleware, as unpatched critical CVEs in widely deployed software are a primary vector for ransomware and data exfiltration.

Shame score — A critical, actively exploited vulnerability in widely deployed healthcare middleware that directly enabled ransomware attacks, representing a severe negligence in patching and software supply-chain security.