Customer Security Newsletter - January 2026

Welcome to the January 2026 MEDITECH Customer Security Newsletter, where we provide you with information and resources to give you insight on security challenges facing your organization and the healthcare community as a whole. Here we endeavor to provide some good information to help you improve your organization's security posture. This data has been gleaned from the review of public records on file with CISA, H-ISAC and Health Sector Cybersecurity Coordination Center (HC3) alerts. Please note the Talk To Us section, as we would like to tailor future editions of the newsletter to address specific concerns.

Known Exploited Vulnerabilities

From December 5 , 2025 until the writing of this bulletin, there have been 17 known exploited vulnerabilities added to CISA's list . They are CVE-2025-55182, CVE-2022-37055, CVE-2025-66644, CVE-2025-6218, CVE-2025-62221, CVE-2025-58360, CVE-2018-4063, CVE-2025-14174, CVE-2025-14611, CVE-2025-43529, CVE-2025-59718, CVE-2025-59374, CVE-2025-40602, CVE-2025-20393, CVE-2025-14733, CVE-2023-52163, and CVE-2025-14847. 

All of these additions are based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks. When looking at the catalog, the CVEs are listed from most recently added by default and the list may be manipulated by using the provided filters. This list was most recently reviewed on January 6, 2026.

Vulnerabilities for Hospitals to Watch Out For

These significant vulnerabilities have been shown to have been weaponized in December 2025 and January 2026. Intelligence indicates a high degree of caution for healthcare infrastructures.

• CVE-2025-55182 (CRITICAL): Remote Code Execution (RCE) in React Server Components
• CVE-2025-59718 (CRITICAL): Single Sign-On Bypass in various Fortinet products
• CVE-2025-20393 (CRITICAL): RCE in Cisco Secure Email Gateway
• CVE-2025-62221 (HIGH): Use After Free in Windows Cloud Files

News

CISA Unveils Enhanced Cross-Sector Cybersecurity Performance Goals

CISA releases the Cross-Sector Cybersecurity Performance Goals (CPGs) version 2.0 on December 11, 2025, which introduces a new governance-focused framework and unified IT/OT security benchmarks to help critical infrastructure organizations counter emerging threats.

Cybersecurity strategies to prioritize now​​

On December 15, 2025, H-ISAC linked an article where Microsoft Deputy CISO Damon Becknel outlines four critical, high-impact pillars—essential cyber hygiene, modernizing protocols, device fingerprinting, and industry collaboration—to help organizations move beyond "guaranteed failure" and build a resilient defense against increasingly common cyberattacks.

Additional Resources

• HHS 405(d) Aligning Health Care Industry Security Approaches  - The 405(d) Program and Task Group is a collaborative effort between industry and the federal government, which aims to raise awareness, provide vetted cybersecurity practices, and move healthcare organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector. Their website provides the latest resources and information as well as an opportunity for involvement.
• Helpful resources CISA has provided can be found on the following pages:
  • Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure
  • StopRansomware.gov
  • Cyber Hygiene Services

Talk to us!

We at MEDITECH would love to hear your feedback about this newsletter and we’d like to know what is on your mind. Is there something you would like us to address?

We also have a question for you that is important to us. What are your largest concerns or security hopes for 2026?

Please let us know bycontacting us!

Until next time, stay alert out there!