LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Baxter Abacus 3.3.5 and earlier leave client to SQL server encryption off by default

MedDevice Cyber Staff · Mar 1 · 2 min read · Via Baxter Abacus-2026-001 bulletin

Baxter published bulletin Abacus-2026-001 in March 2026. ABACUS Software allows a user to configure communication between the client application and the SQL server without encryption, and encryption is not enabled by default in versions 3.3.5 and prior.

Sensitive data could therefore cross the network in plaintext. Any site on 3.3.5 or earlier should assume the default holds until someone checks the setting.

A setting that ships off stays off in most installs, so turn it on and then confirm nobody turned it back off.

Are you a representative of Baxter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Enable encryption between the ABACUS client and the SQL server on every install at 3.3.5 or earlier, following Baxter's Abacus-2026-001 bulletin. Verify the setting on each client, not just the server.

Enable transport encryption. Turn on client to SQL server encryption per Baxter's bulletin.
Verify every client. Check each ABACUS client connection actually negotiates encryption.
Lock the configuration. Restrict who can change the connection settings so the default cannot creep back.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Patient or study database

ABACUS Software

PID-4112 Patient or study database

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

What does Baxter bulletin Abacus-2026-001 cover?

Baxter bulletin Abacus-2026-001, published in March 2026, says ABACUS Software can run client to SQL server communication without encryption, and encryption is not enabled by default in versions 3.3.5 and prior, which could expose sensitive data in plaintext.

Which ABACUS Software versions have encryption off by default?

Baxter says encryption between the ABACUS client application and the SQL server is not enabled by default in ABACUS Software versions 3.3.5 and prior.

← Back to Vulnerabilities