LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Cepheid GeneXpert Xpertise 7.1 needs .NET October 2025 update for CVE-2025-55248

MedDevice Cyber Staff · Mar 11 · 2 min read · Via Cepheid product security updates

A second .NET notice from Cepheid landed on March 11, 2026. The .NET runtime on GeneXpert Xpertise 7.1 is missing Microsoft's October 2025 security update, KB5066136. That update fixes CVE-2025-55248, a .NET remote code execution vulnerability, and delivers .NET SDK 9.0.111.

Infinity customers are told to apply KB5066136 from the catalog link Cepheid provides. Automatic updates cover it; manual sites must install it. Two .NET major versions on one instrument means two patch streams to track.

Are you a representative of Cepheid? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Microsoft update KB5066136 (.NET SDK 9.0.111) on GeneXpert Xpertise 7.1 to fix CVE-2025-55248, per Cepheid's March 11, 2026 notice. Automatic updates cover it. Track both the .NET 8 and .NET 9 runtimes on the system.

Install KB5066136. Apply the .NET SDK 9.0.111 package from Cepheid's linked Microsoft catalog download on systems without automatic updates.
Inventory runtimes. List every .NET runtime present on each Xpertise 7.1 system, since this notice and the June one cover different versions.
Verify after patching. Confirm the installed .NET versions and run a test order before returning the system to clinical use.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Named operating system

GeneXpert Xpertise

PID-312 Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-55248 on Cepheid GeneXpert Xpertise 7.1?

CVE-2025-55248 is a .NET remote code execution vulnerability. Cepheid's March 11, 2026 notice says GeneXpert Xpertise 7.1 needs Microsoft update KB5066136, which ships .NET SDK 9.0.111, to fix it.

Is KB5066136 required on Cepheid Infinity systems?

Yes, for Infinity customers using GeneXpert Xpertise 7.1 without automatic updates. Cepheid says systems with automatic updates need no further action.

← Back to Vulnerabilities