Updated under an hour ago ()
Vulnerabilities and vendors
Which health IT products carry published and exploited vulnerabilities, and what should a program do about it?
498 CVEs in mapped health IT products were published in 2022 to 2026, across 32 vendors in 8 categories. 1 of them is on CISA's list of vulnerabilities exploited in the wild. Across all exploited CVEs, the median gap from publication to confirmed exploitation was 8 days.
What this means for you
The median gap from publication to confirmed exploitation is 8 days, and 26% were confirmed on or before publication: a monthly or quarterly patch cycle cannot be the only answer for internet-facing systems.
Do this next
This chapter's program actions come with a subscription
a. Exploited in the wild
Which health IT vulnerabilities attackers are known to use
Health IT CVEs in the KEV catalog
CISA added 1,437 CVEs to its Known Exploited Vulnerabilities catalog in 2022 to 2026; 7 affect mapped health IT products (under 1%), from Siemens Healthineers (5), NextGen Healthcare (1) and Oracle Health (Cerner) (1). 6 of them are in a component the product embeds (Microsoft and jQuery), not the vendor's own code: the fix is the component's patch, which a device or clinical system often gets only after its vendor validates it. 6 are known to be used in ransomware campaigns. Exploitation concentrates in general infrastructure; health IT entries are few but name products clinical operations depend on.
| CVE-2020-11023 | Oracle Health (Cerner) | Healthcare Translational | jQuery component | 2025-01-23 | Not known | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| CVE-2023-43208 | NextGen Healthcare | Mirth Connect | Vendor's own code | 2024-05-20 | Known | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| CVE-2017-0147 | Siemens Healthineers | Acuson, Syngo | Microsoft component | 2022-05-24 | Known | Apply updates per vendor instructions. |
| CVE-2017-0148 | Siemens Healthineers | Acuson, Syngo | Microsoft component | 2022-04-06 | Known | Apply updates per vendor instructions. |
| CVE-2017-0146 | Siemens Healthineers | Acuson, Syngo | Microsoft component | 2022-03-25 | Known | Apply updates per vendor instructions. |
| CVE-2017-0144 | Siemens Healthineers | Acuson, Syngo | Microsoft component | 2022-02-10 | Known | Apply updates per vendor instructions. |
| CVE-2017-0145 | Siemens Healthineers | Acuson, Syngo | Microsoft component | 2022-02-10 | Known | Apply updates per vendor instructions. |
Sources: CISA Known Exploited Vulnerabilities catalog; CVE Program, cvelistV5 records; NIST NVD CVE API
How this is calculated
Health IT entries: CVEs in CISA's Known Exploited Vulnerabilities catalog whose affected products include a mapped health IT vendor or product, counted by the year CISA added them. An entry is in an embedded component when the CNA's own record lists no mapped health product (NVD added the health products that ship the component); for records without CNA product data, when another vendor's CNA published it naming its own product, or it names more products of other vendors (Linux distributions aside) than mapped health products, as when NVD lists an imaging system because it runs an affected Windows version. Ransomware-linked means CISA's knownRansomwareCampaignUse field reads "Known". A CVE affecting two categories counts in each. The context chart counts every catalog entry added in the same years by the vendor of its first affected product. Medical advisories are CISA ICS medical advisories (ICSMA) collected by Signals whose text names the CVE; Signals has collected them since September 2026, so earlier advisories are missing.
Context: KEV additions by vendor, all products
Across the whole catalog, Microsoft has the most additions in these years (308).
Every catalog entry, not only health IT: the infrastructure around clinical systems.
Table view
| Microsoft | 308 |
| Cisco | 89 |
| Adobe | 76 |
| Apple | 72 |
| 65 | |
| Oracle | 38 |
| Fortinet | 28 |
| Ivanti | 28 |
| Dlink | 23 |
| Linux | 23 |
Health IT KEV entries by category
By category, imaging and PACS (5), EHR and practice management (1), integration and interoperability (1).
Table view
| Imaging and PACS | 5 |
| EHR and practice management | 1 |
| Integration and interoperability | 1 |
Health IT share of KEV additions, by year added
Health IT's share of KEV additions by year; 6 of the health IT entries are ransomware-linked.
Sources: CISA Known Exploited Vulnerabilities catalog
Table view
| 2022 | 555 | 5 | 1% |
| 2023 | 187 | 0 | 0% |
| 2024 | 186 | 1 | 1% |
| 2025 | 245 | 1 | under 1% |
| 2026 | 264 | 0 | 0% |
Subscriber feature · $5 a month or $50 a year
Read the rest of Chapter 9: Vulnerabilities and vendors
- Days from CVE publication to confirmed exploitation
- Health IT CVEs by vendor, severity and year
- How vendors disclose: own CNA, advisories, lead time
- Which weaknesses recur, and the control that answers each
- EHR, devices, imaging, integration and the rest side by side
- Do exploited-vulnerability waves show up in OCR hacking reports?
- Three actions per category, chosen by the data
- What this means for your program: 4 key points
- 4 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Run the KEV catalog against your inventory every week”
- Exam angle for 7 CISSP, CISM and CISA domains, with a study prompt
Included with an ExamPrep subscription or as a DueCare site administrator. How linking works