Vulnerability

Philips lists Vue PACS 12.2 under the critical Mirth Connect flaws in ICSMA-26-253-01

MedDevice Cyber Staff · Oct 8 · 2 min read · Via Philips security advisories

Philips posted an advisory on October 8, 2026 on the NextGen Healthcare Mirth Connect vulnerabilities in CISA advisory ICSMA-26-253-01: CVE-2026-78224, CVE-2026-82578 and CVE-2026-82583. Philips calls them critical. One product is on its list, 839001 Vue PACS 12.2, and Philips states that products not listed should be considered not impacted.

The fix runs through Philips itself. According to the advisory, the Philips hosting business is in the process of developing, validating and deploying the patches to the managed infrastructure. The notice gives no fixed version and no completion date.

Mirth Connect is an integration engine, so a flaw in it touches the data flowing between the PACS and everything it talks to. Hosted Vue PACS customers should ask Philips for the date their environment was patched.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips is patching the Mirth Connect component of Vue PACS 12.2 on its managed hosting infrastructure; it names no fixed version. Hosted customers should get written confirmation and a date once the patch for CVE-2026-78224, CVE-2026-82578 and CVE-2026-82583 is in place. Customers running Mirth Connect outside Philips hosting should check their own instances against ICSMA-26-253-01.

Confirm the hosted patch date. Ask Philips when the Mirth Connect patches reached the managed infrastructure serving your Vue PACS 12.2 environment.
Find other Mirth Connect instances. Search interface servers for Mirth Connect installs outside the Philips-hosted stack and patch them against ICSMA-26-253-01.
Restrict interface engine access. Allow connections to Mirth Connect listeners only from known clinical systems.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Is Philips Vue PACS 12.2 affected by the Mirth Connect vulnerabilities in ICSMA-26-253-01?

Yes. Philips listed 839001 Vue PACS 12.2 in its October 8, 2026 advisory on the critical NextGen Healthcare Mirth Connect flaws CVE-2026-78224, CVE-2026-82578 and CVE-2026-82583 covered by CISA advisory ICSMA-26-253-01.

How is Philips fixing the Mirth Connect flaws in Vue PACS?

Philips said on October 8, 2026 that its hosting business is developing, validating and deploying the patches for CVE-2026-78224, CVE-2026-82578 and CVE-2026-82583 to the managed infrastructure behind Vue PACS 12.2. It named no fixed version or completion date.

← Back to Vulnerabilities