Cisa

NextGen Healthcare Mirth Connect versions 4.7.1 and earlier contain three critical vulnerabilities including SQL injection and XML External Entity (XXE) injection flaws that allow for unauthorized data access and denial-of-service.

Multiple vulnerabilities in CISA Malcolm, including RCE, path traversal, and resource exhaustion, allow authenticated attackers to execute arbitrary code or cause denial-of-service.

CISA published ICS advisories between May 25 and 31, 2026, addressing vulnerabilities across various vendors including ABB, CP Plus, Eppendorf, Frontier, Jinan USR IOT, KMW, MacGregor, Schneider Electric, and XCharge, impacting industrial control systems and related applications.

CISA is urging hardening of endpoint management systems following a cyberattack against a US organization, highlighting the potential for significant impact via compromised management infrastructure.