CVE-2023-43208
KEV RANSOMWARECRITICAL 9.8EPSS 82.7%
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 82.71% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-05-20, used in ransomware campaigns
- Nuclei
- critical
- Published
- 2023-10-26
- Updated
- 2025-10-21
Proof-of-concept exploits (17)
- http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution…
- https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-202…
- Avento/CVE-2023-43208_Detection_PoC2★ · 2024-11-28
- J4F9S5D2Q7/CVE-2023-43208-MIRTHCONNECT0★ · 2024-06-09
- gotr00t0day/NextGen-Mirth-Connect-Exploit8★ · 2024-03-19
- jakabakos/CVE-2023-43208-mirth-connect-rce-poc7★ · 2024-03-18
- 4nuxd/CVE-2023-432080★ · 2026-03-12
- Criz117/CVE-2023-43208-PoC1★ · 2026-03-13
- D3m0nicw0lf/CVE-2023-432080★ · 2026-02-25
- Humberto-pixel/CVE-2023-43208-PoC0★ · 2026-03-28
- LunaLynx12/cve-2023-43208-poc0★ · 2026-03-12
- MKIRAHMET/PoC-2023-432083★ · 2026-02-24
- Pegasus0xx/CVE-2023-432081★ · 2026-03-01
- az4rvs/Mirth-Connect-CVE-2023-432082★ · 2026-03-08
- kyakei/CVE-2023-432083★ · 2026-02-22
- predyy/CVE-2023-432085★ · 2026-02-25
- azrvs/Mirth-Connect-CVE-2023-432082★ · 2026-03-08