LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Cepheid GeneXpert Xpertise 7.1 VSTA carries privilege escalation CVE-2025-29803

MedDevice Cyber Staff · Mar 11 · 2 min read · Via Cepheid product security updates

Cepheid issued a Critical Vulnerability Notification on March 11, 2026 for Visual Studio Tools for Applications (VSTA) on GeneXpert Xpertise 7.1. The installed VSTA predates 16.0.35907.0 and 17.0.35906.0. The flaw is CVE-2025-29803, an uncontrolled search path element.

An attacker with local access could make VSTA load malicious files from an untrusted directory and escalate privileges, Cepheid says. Microsoft fixed it in those two VSTA builds, and Cepheid links the installer. Local access on a shared lab bench is easier to get than it sounds, so patch this one with the network flaws.

Are you a representative of Cepheid? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade Visual Studio Tools for Applications on GeneXpert Xpertise 7.1 to 16.0.35907.0, 17.0.35906.0 or later to fix CVE-2025-29803, per Cepheid's March 11, 2026 notice. Restrict who can log on locally and write to directories the application loads from.

Upgrade VSTA. Install the VSTA build linked in Cepheid's notice and confirm the version is 16.0.35907.0, 17.0.35906.0 or later.
Tighten local logon. Limit interactive logon on Xpertise workstations to named lab staff with standard accounts.
Lock down writable paths. Check that standard users cannot write to directories the instrument software loads code from.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Off-the-shelf software

GeneXpert Xpertise

Off-the-shelf software

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-29803 in Cepheid GeneXpert Xpertise 7.1?

CVE-2025-29803 is an uncontrolled search path element flaw in Visual Studio Tools for Applications. Cepheid's March 11, 2026 notice says a local attacker could use it to escalate privileges on GeneXpert Xpertise 7.1.

Which VSTA version fixes CVE-2025-29803 on Cepheid systems?

Cepheid tells GeneXpert Xpertise 7.1 customers to upgrade to VSTA 16.0.35907.0, 17.0.35906.0 or later.

← Back to Vulnerabilities