Vulnerability

Philips lists IntelliVue XDS and Guardian under exploited Windows kernel CVE-2025-62215

MedDevice Cyber Staff · Nov 19 · 2 min read · Via Philips product security advisories 2025

On November 19, 2025, Philips posted a notice on CVE-2025-62215, a zero day in the Windows kernel. Microsoft's Threat Intelligence Center confirmed active exploitation in the wild. The listed products are Advanced Visualization Workspace (V15), IntelliVue Guardian Software, IntelliVue XDS and IntelliSpace Perinatal.

Active exploitation moves this ahead of the normal patch queue. Philips policy allows only Philips authorized changes on these systems, so the patch reaches the device through Philips service.

Kernel zero days are post-exploitation tools. The attacker who uses one is already on the host, so check the listed systems for signs of that first step too.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Prioritize the Philips validated Windows update for CVE-2025-62215 on Advanced Visualization Workspace 15, IntelliVue Guardian Software, IntelliVue XDS and IntelliSpace Perinatal. Review the hosts for signs of an initial compromise.

Pull the product list. Match the listed Philips products against the installed base, including catalogue numbers and versions.
Ask Philips service for the status. Get the validated patch or the interim mitigation for each listed system before applying anything yourself.
Hunt on the hosts. Review endpoint logs on the listed systems for unexpected processes or logons.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system

Contributing

Off-the-shelf software Hospital network

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

Is CVE-2025-62215 being exploited?

Yes. Philips noted on November 19, 2025 that Microsoft's Threat Intelligence Center confirmed CVE-2025-62215, a Windows kernel zero day, is actively exploited in the wild.

Which Philips products are affected by CVE-2025-62215?

Philips listed Advanced Visualization Workspace (V15), IntelliVue Guardian Software, IntelliVue XDS and IntelliSpace Perinatal in its November 19, 2025 notice on CVE-2025-62215.

← Back to Vulnerabilities