{"id":"CVE-2023-43208","published":"2023-10-26T17:15:09Z","modified":"2026-06-17T06:25:15Z","title":"NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability","vendor":"NextGen Healthcare","product":"Mirth Connect","tier":"core","eol":null,"description":{"text":"NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","provenance":"source","from":"NVD"},"summary":{"text":"A deserialization of untrusted data flaw in NextGen Healthcare's Mirth Connect, in versions before 4.4.1, stems from an incomplete patch of an earlier issue. An unauthenticated remote attacker with network access can trigger remote code execution, requiring no credentials, no user interaction, and no special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:41Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.85886,"percentile":0.99728,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2024-05-20","dueDate":"2024-06-10","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status.   For more information, please see: https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New ;  https://nvd.nist.gov/vuln/detail/CVE-2023-43208","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-03-07","exploitedFirstSeen":"2024-03-07","ransomware":true,"evidence":[{"url":"https://github.com/nextgenhealthcare/connect/discussions/6124","date":"2024-03-07"},{"url":"https://x.com/MsftSecIntel/status/1781353319341928668","date":"2024-04-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-05-20"},{"url":"https://censys.com/cve-2023-43208/","date":"2024-05-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-25&host_type=src&vulnerability=cve-2023-43208","date":"2024-05-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-26&host_type=src&vulnerability=cve-2023-43208","date":"2024-05-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-27&host_type=src&vulnerability=cve-2023-43208","date":"2024-05-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-28&host_type=src&vulnerability=cve-2023-43208","date":"2024-05-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-29&host_type=src&vulnerability=cve-2023-43208","date":"2024-05-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-30&host_type=src&vulnerability=cve-2023-43208","date":"2024-05-30"}],"evidenceTotal":629,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43208","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"is vulnerable to unauthenticated remote code execution","start":54,"end":108}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote code execution yields command interpreter access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"is vulnerable to unauthenticated remote code execution","start":54,"end":108}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-47627","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-47627","exploited":true,"exploitedSince":"2024-05-20","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":2,"earliest":"2024-03-17","earliestUrl":"https://github.com/jakabakos/CVE-2023-43208-mirth-connect-rce-poc","repos":[{"name":"jakabakos/CVE-2023-43208-mirth-connect-rce-poc","url":"https://github.com/jakabakos/CVE-2023-43208-mirth-connect-rce-poc","stars":7,"created":"2024-03-17"},{"name":"predyy/CVE-2023-43208","url":"https://github.com/predyy/CVE-2023-43208","stars":5,"created":"2026-02-25"},{"name":"kyakei/CVE-2023-43208","url":"https://github.com/kyakei/CVE-2023-43208","stars":3,"created":"2026-02-22"},{"name":"MKIRAHMET/PoC-2023-43208","url":"https://github.com/MKIRAHMET/PoC-2023-43208","stars":3,"created":"2026-02-24"},{"name":"Avento/CVE-2023-43208_Detection_PoC","url":"https://github.com/Avento/CVE-2023-43208_Detection_PoC","stars":2,"created":"2024-11-28"}]},"metasploit":[{"name":"Mirth Connect Deserialization RCE","module":"exploit/multi/http/mirth_connect_cve_2023_43208","type":"exploit","disclosureDate":"2023-10-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb"}],"nuclei":[{"id":"CVE-2023-43208","name":"NextGen Healthcare Mirth Connect - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-43208.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-43208.yaml"}],"first":{"date":"2023-10-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html","https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2023-10-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-03-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb","provenance":"source"},{"date":"2023-10-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43208","provenance":"source"},{"date":"2024-03-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://github.com/nextgenhealthcare/connect/discussions/6124","provenance":"source"},{"date":"2024-05-20","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-05-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-47627","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":207},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 968 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-nextgen-healthcare-mirth-connect-cve-2023-37679","parents":[{"from":"CVE-2023-37679","to":"CVE-2023-43208","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.","from":"NVD","in":"CVE-2023-43208"}]}]}}