Vulnerability

Cepheid GeneXpert Dx, Xpress and Xpertise systems need SQL Server security updates

MedDevice Cyber Staff · Mar 11 · 3 min read · Via Cepheid product security updates

Cepheid published a Critical Vulnerability Notification on March 11, 2026 for the Microsoft SQL Server component of three GeneXpert software lines: Dx 6.4a, Xpress 6.4a and Xpertise 7.1. The databases are missing the September 2025 update KB5065222 and the November 2025 updates KB5068402 and KB5068404. CVEs in scope include CVE-2024-21907, CVE-2025-47997, CVE-2025-55229 and CVE-2025-59499.

Cepheid says missing updates may allow unauthorized command execution, improper input handling, information disclosure or privilege escalation. The target builds are explicit. Dx 6.4a and Xpress 6.4a run SQL Server 2017 and should reach 14.0.3515.1 through KB5068402. Xpertise 7.1 runs SQL Server 2019 and should reach 15.0.4445.1 through KB5065222.

The notice tells sites to back up the database through the software interface first, following the validated Operator Manual procedure. That database holds the test results. The sqlservr.exe version number is the acceptance test, so record it for every analyzer after the install.

Are you a representative of Cepheid? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Back up the GeneXpert database using the Operator Manual procedure, then install KB5068402 on Dx 6.4a and Xpress 6.4a (SQL Server 2017, target 14.0.3515.1) and KB5065222 on Xpertise 7.1 (SQL Server 2019, target 15.0.4445.1). Confirm the sqlservr.exe version after installation. Cepheid's March 11, 2026 notice lists the download links.

Back up through the software. Run the validated database backup from the Dx, Xpress or Xpertise interface as the Operator Manual describes.
Check the build. Read the sqlservr.exe version; patch any 2017 instance below 14.0.3515.1 or 2019 instance below 15.0.4445.1.
Install the matching update. Apply KB5068402 to SQL Server 2017 on Dx and Xpress 6.4a, and KB5065222 to SQL Server 2019 on Xpertise 7.1.
Confirm the version. Recheck sqlservr.exe and run a test order end to end before returning the analyzer to service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database Off-the-shelf software

Contributing

Handles patient data

GeneXpert Dx

Patient or study database Off-the-shelf software

GeneXpert Xpress

Patient or study database

GeneXpert Xpertise

Patient or study database

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which SQL Server version should Cepheid GeneXpert Dx 6.4a run after patching?

Cepheid's March 11, 2026 notice says GeneXpert Dx 6.4a and Xpress 6.4a, on SQL Server 2017, should be at 14.0.3515.1 after installing KB5068402.

What SQL Server update does Cepheid GeneXpert Xpertise 7.1 need?

Xpertise 7.1 runs SQL Server 2019 and needs the September 2025 update KB5065222, which brings it to 15.0.4445.1, according to Cepheid's March 11, 2026 notice.

Are CVE-2024-21907 and CVE-2025-47997 relevant to Cepheid GeneXpert?

Yes. Cepheid lists both among the SQL Server CVEs in scope for GeneXpert Dx 6.4a, Xpress 6.4a and Xpertise 7.1 in its March 11, 2026 notice.

← Back to Vulnerabilities