LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Siemens Healthineers discloses local privilege escalation in Medicalis Workflow Orchestrator

MedDevice Cyber Staff · Jul 8 · 2 min read · Via Siemens Healthineers security disclosure

Siemens Healthineers published advisory SHSA-501799 on July 8, 2024, disclosing CVE-2024-37999 in Medicalis Workflow Orchestrator. All versions are affected. The flaw lets a local attacker escalate privileges.

Siemens Healthineers recommended countermeasures for products where fixes are not, or not yet, available. A local escalation needs a foothold first, so the practical control is limiting who can log on to the server and what runs there.

Are you a representative of Siemens Healthineers? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the countermeasures in SHSA-501799 to every Medicalis Workflow Orchestrator server and restrict local and interactive logon to named administrators. Install a Siemens Healthineers fix when one is published.

Restrict local access. Limit interactive and remote logon on Medicalis Workflow Orchestrator servers to named administrators.
Apply vendor countermeasures. Follow the SHSA-501799 guidance for CVE-2024-37999 on each installation.
Watch for a fix. Track the advisory and deploy the Siemens Healthineers update once released.

For Device ManufacturersFix the class in the product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2024-37999 in Medicalis Workflow Orchestrator?

CVE-2024-37999 is a privilege escalation vulnerability in all versions of Siemens Healthineers Medicalis Workflow Orchestrator that could let a local attacker escalate privileges, disclosed in SHSA-501799 on July 8, 2024.

Is there a fix for Medicalis Workflow Orchestrator CVE-2024-37999?

In SHSA-501799 of July 8, 2024, Siemens Healthineers recommended countermeasures for products where fixes are not, or not yet, available for CVE-2024-37999 in Medicalis Workflow Orchestrator.

← Back to Vulnerabilities