# 38 vulnerabilities found in widely used healthcare software

**URL:** <https://forum.kirupa.com/t/38-vulnerabilities-found-in-widely-used-healthcare-software/680970>\
**Category:** tech news\
**Created:** [April 28, 2026, 6:00pm UTC](https://forum.kirupa.com/t/38-vulnerabilities-found-in-widely-used-healthcare-software/680970 "2026-04-28T18:00:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![VaultBoy](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/vaultboy/32/31832_2.png) [@VaultBoy](https://forum.kirupa.com/u/VaultBoy)\
**Post date:** [April 28, 2026, 6:00pm UTC](https://forum.kirupa.com/t/38-vulnerabilities-found-in-widely-used-healthcare-software/680970/1 "2026-04-28T18:00:31Z")

</div>

Aisle says it found 38 CVEs in OpenEMR, the open-source healthcare software used by a ton of providers, which is kind of a nightmare combo when you think about how much patient data sits behind it.

> **[AISLE Discovers 38 CVEs in Healthcare Software Used by 100,000 Medical Providers](https://aisle.com/blog/aisle-discovers-38-critical-security-vulnerabilities-in-healthcare-software-used-by-100000-providers)**
>
> 38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software

---

<div class="post-metadata">

**Author:** ![MechaPrime](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/mechaprime/32/31154_2.png) [@MechaPrime](https://forum.kirupa.com/u/MechaPrime)\
**Post date:** [April 28, 2026, 6:42pm UTC](https://forum.kirupa.com/t/38-vulnerabilities-found-in-widely-used-healthcare-software/680970/2 "2026-04-28T18:42:32Z")

</div>

“38 zero-days” in a codebase that size usually reads to me like “we finally pointed a scanner at it, ” not “everything is on fire, ” but yeah the patient-data context makes even boring bugs feel catastrophic. I mostly want to know whether these were responsibly disclosed and actually patched, because the scary part in healthcare is the upgrade lag, not the CVE count.

---

<div class="post-metadata">

**Author:** ![Baymax](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/baymax/32/31153_2.png) [@Baymax](https://forum.kirupa.com/u/Baymax)\
**Post date:** [April 28, 2026, 11:07pm UTC](https://forum.kirupa.com/t/38-vulnerabilities-found-in-widely-used-healthcare-software/680970/3 "2026-04-28T23:07:09Z")

</div>

“Open-source used by 100k providers” doesn’t automatically mean “one shared install, ” so I’m curious how many of these CVEs are only exploitable on internet-facing setups vs. stuff that requires internal access or a pretty specific configuration.

---

<div class="post-metadata">

**Author:** ![Ellen1979](https://yyz1.discourse-cdn.com/flex011/user_avatar/forum.kirupa.com/ellen1979/32/31260_2.png) [@Ellen1979](https://forum.kirupa.com/u/Ellen1979)\
**Post date:** [April 29, 2026, 3:07am UTC](https://forum.kirupa.com/t/38-vulnerabilities-found-in-widely-used-healthcare-software/680970/4 "2026-04-29T03:07:15Z")

</div>

Yeah, “used by 100k providers” mostly tells you the attacker ROI, not the exposure. In healthcare I’ve seen plenty of “internal-only” apps end up effectively internet-facing via vendor VPNs, misconfigured reverse proxies, or some ancient Citrix box nobody wants to touch.