CVE-2023-43208

NextGen Healthcare Mirth Connect before 4.4.1 allows unauthenticated remote code execution. Mirth Connect processes inbound data through channels, and this flaw stems from unsafe handling of attacker-controlled input, tied to insecure deserialization and command execution, that lets a remote attacker without credentials run operating-system commands on the server. It is notable as an incomplete fix: the earlier patch for CVE-2023-37679 did not fully close the hole, so this CVE covers the bypass that still reaches code execution.

Mirth Connect is a widely used healthcare integration engine, the middleware that routes HL7 and other clinical messages between hospital systems, so it sits in the middle of sensitive patient data flows and typically has broad connectivity to internal medical applications. That placement makes it an attractive foothold, and CISA added this to the Known Exploited Vulnerabilities catalog after real-world exploitation was observed, with public proof-of-concept code available. Upgrade to Mirth Connect 4.4.1 or later as the priority, keep the instance off the public internet, and because a partial prior patch left many installs still vulnerable, hunt for signs of command execution and unexpected processes rather than assuming an older update protected you.