LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // B. Braun

B. Braun

B. Braun in MedDevice Cyber coverage: 9 stories, 9 products named, 35 CVEs, and the company's own disclosures.

Public disclosure program
Follow B. BraunClaim this page
Stories
9
Products named
9
Product CVEs
35
Responses on record
0
Latest story
Sep 29, 2026

Coverage

9 stories
01
Vulnerability

B. Braun OnlineSuiteplus inherits a Keycloak password reset flaw, CVE-2026-18963

B. Braun's September 29, 2026 statement says OnlineSuiteplus Platform Administration 3.0.0, when a specific non-default parameter was changed, is affected by Keycloak CVE-2026-18963 (CVSS 9.1 v3.1, 9.4 v4.0), which lets an unauthenticated attacker force password resets.

B. BraunSep 293 min read
02
Vulnerability

B. Braun OnlineSuite AP 3.0 flaws allow remote code execution with highest privileges

B. Braun's June 6, 2025 statement covers CVE-2025-3321, CVE-2025-3322 and CVE-2025-3365 in OnlineSuite AP 3.0 and earlier, scored CVSS 10.0 and fixed by FSI 14-25; CODE WHITE GmbH reported them.

B. BraunJun 63 min read
03
Vulnerability

B. Braun Battery Pack SP with Wi-Fi web server eval injection gives root on the pump module

CISA advisory ICSMA-23-103-01 covers CVE-2023-0888 (CVSS v3 5.5), eval injection in the B. Braun Battery Pack SP with Wi-Fi embedded web server that lets an authenticated user gain root on the infusion pump communication module. B. Braun released software updates.

CISAApr 132 min read
04
Vulnerability

B. Braun Infusomat Space pump communication module accepts unsigned data sets from the network

CISA advisory ICSMA-21-294-01 covers five vulnerabilities in B. Braun SpaceCom2, Battery Pack SP with Wi-Fi and Data module compactPlus used with the Infusomat Space Large Volume Pump, led by CVE-2021-33885 (CVSS v3 9.0), missing signature checks on critical data sets. B. Braun released software updates.

CISAOct 213 min read
05
Vulnerability

B. Braun names the Outlook 400ES pump as its only product with Ripple20 Treck code

B. Braun's October 2021 update says the Outlook 400ES infusion pump is its only product using the vulnerable Treck TCP/IP code, scores CVE-2020-11903, CVE-2020-11906, CVE-2020-11912 and CVE-2020-11914 at 0.0 for it, and ships enhancement software 151738.

B. BraunOct 82 min read
06
Vulnerability

B. Braun OnlineSuite ships WIBU CodeMeter with six vulnerabilities scored up to 9.8

B. Braun's February 24, 2021 notice says OnlineSuite AP 2.1.2 and 3.0 deliver third-party WIBU CodeMeter affected by CVE-2020-14509 and five related CVEs (CVSS v3 9.8); the issue is server-side only.

B. BraunFeb 242 min read
07
Vulnerability

B. Braun OnlineSuite AP 3.0 and earlier allows unauthenticated file upload and DLL hijacking

CISA advisory ICSMA-20-296-01 reports relative path traversal (CVE-2020-25172, CVSS v3 8.6), DLL hijacking (CVE-2020-25174, 8.4) and Excel macro injection (CVE-2020-25170, 6.9) in B. Braun OnlineSuite Version AP 3.0 and earlier. B. Braun has an update available through its local organizations.

CISAOct 224 min read
08
Vulnerability

B. Braun SpaceCom and Battery Pack SP with Wi-Fi carry 11 flaws from XSS to unsigned firmware

CISA advisory ICSMA-20-296-02 covers 11 vulnerabilities, including CVE-2020-25150 path traversal file upload and CVE-2020-25166 firmware signature bypass, in B. Braun SpaceCom, Battery Pack SP with Wi-Fi at L81/U61 and earlier and Data module compactplus A10 and A11. B. Braun released software updates.

CISAOct 224 min read
09
Vulnerability

B. Braun SpaceStation with SpaceCom module has an open redirect in its web server

CISA advisory ICSMA-17-082-02 covers CVE-2017-6018, an open redirect (CWE-601, CVSS v3 5.4) in the web server of B. Braun SpaceStation units with the SpaceCom module before software 012U000040. B. Braun points users to its download site for the update.

CISAMar 232 min read

Products in our coverage

  • OnlineSuiteplus Platform Administration 3.0.0 (non-default parameter changed) infusion management server software
  • OnlineSuite AP 3.0 and earlier (including FSI-06-2020 patch) infusion management server software
  • Battery Pack SP with Wi-Fi 053L000091 (global) / 054U000091 (U.S.); 053L000092 (global) / 054U000092 (U.S.) infusion pump wireless battery module
  • SpaceStation with SpaceCom 2 012U000061 and earlier; L81 and earlier infusion pump communication module
  • Battery Pack SP with Wi-Fi 028U000061 and earlier; L81 and earlier infusion pump wireless battery module
  • Data module compactPlus A10 infusion pump communication module
  • Outlook 400ES infusion pump enhancement software 151738 Rev A / 151738 MP infusion pump
  • SpaceCom L81/U61 and earlier infusion pump communication module
  • SpaceStation with SpaceCom module SpaceStation 8713140U with SpaceCom 8713160U, and SpaceStation with integrated SpaceCom 8713142U, software before 012U000040 infusion docking station communication module

Products and threat intel

5

B. Braun products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.

ProductDevice typeAttributesMatched advisories
ELAN 4 Electro Motor SystemDrills, Burrs, Trephines & Accessories (Simple, Powered)91
Aesculap Caiman 12 Seal and Cut Technology SystemElectrosurgical, Cutting & Coagulation & Accessories10
Aesculap Caiman 5 Seal and Cut Technology SystemElectrosurgical, Cutting & Coagulation & Accessories10
IV Sets not made with PVCSet, Administration, Intravascular20
SpaceStation MRIAccessories, Pump, Infusion40

CVEs in coverage of B. Braun products

CVE-2017-6018 CVE-2020-11903 CVE-2020-11906 CVE-2020-11912 CVE-2020-11914 CVE-2020-14509 CVE-2020-14513 CVE-2020-14515 CVE-2020-14517 CVE-2020-14519 CVE-2020-16233 CVE-2020-16238 CVE-2020-25150 CVE-2020-25152 CVE-2020-25154 CVE-2020-25156 CVE-2020-25158 CVE-2020-25160 CVE-2020-25162 CVE-2020-25164 CVE-2020-25166 CVE-2020-25168 CVE-2020-25170 CVE-2020-25172 CVE-2020-25174 CVE-2021-33882 CVE-2021-33883 CVE-2021-33884 CVE-2021-33885 CVE-2021-33886 CVE-2023-0888 CVE-2025-3321 CVE-2025-3322 CVE-2025-3365 CVE-2026-18963
← All manufacturers