#healthcare

Analysis · May 20, 2026 · Colten Anderson

The most dangerous server in the hospital is the one nobody can name

Mirth Connect moves patient records between systems and runs with high privileges, and a lot of installs sit on the open internet. CVE-2023-43208 is an unauthenticated RCE in it, and it's a patch bypass: the first fix used a denylist, and a researcher walked around it.