Mirth Connect ≤4.7.1 hit by three high-severity SQL and XXE flaws
Two of the three vulnerabilities are unauthenticated, and the authenticated one exposes stored system credentials, a patch-or-isolate situation for healthcare data integrators.
TL;DR
CISA published an advisory for three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: an authenticated SQL injection (CVE-2026-82583, CVSS 8.3) that can disclose stored credentials for connected systems, and two unauthenticated XXE injection flaws (CVE-2026-78224, CVSS 8.2; CVE-2026-82578, CVSS 7.5) that permit data exfiltration and denial of service. The vulnerabilities affect healthcare organizations and managed service providers worldwide running the data integration platform. NextGen recommends upgrading to v4.7.2. CISA states no known public exploitation has been reported to the agency at this time.
Three independent vulnerabilities in the same Mirth Connect release (two reachable without authentication, the third exposing stored system credentials) put healthcare organizations running the widely deployed integration engine on a short remediation clock. CISA published the advisory September 10, and the fix is straightforward: upgrade to version 4.7.2 or later.
SQL injection through the Database Connector API
CVE-2026-82583 (CVSS 3.1: 8.3, CVSS 4.0: 7.2) is the one flaw that requires authentication, but that's cold comfort in a platform where, as the advisory notes, successful exploitation can disclose stored credentials for connected systems. An attacker who lands a single valid user account can pivot to arbitrary SQL, write files, and trigger denial of service. The Database Connector API is core to what Mirth Connect does: moving data between systems. Restricting access to that API is the only mitigation short of patching.
Two XXE vectors, both unauthenticated
CVE-2026-78224 (CVSS 3.1: 8.2) lives in the XSLT Transformer Step, which builds a bare TransformerFactory without proper security options. CVE-2026-82578 (CVSS 3.1: 7.5) triggers when XML batch processing is enabled and the XPath option is selected, the raw batch input runs through a default XPath/JAXP setup with no entity restrictions. Both allow data exfiltration and denial of service without authentication.
The XXE pair shares a root cause: XML parsing configurations that don't disable external entity resolution. That two separate code paths in the same version ship with the same class of configuration gap suggests the issue wasn't a one-off oversight.
What the practitioner faces Monday
The patch is available now through the NextGen Healthcare customer portal. There's no configuration flag to neuter the XXE flaws short of disabling the affected features (XSLT Transformer and XML batch processing with XPath) and no workaround for the SQL injection beyond locking down Database Connector API access. CISA reports no known public exploitation, but the advisory's standard defensive guidance (minimize network exposure, isolate behind firewalls, use VPNs) applies with particular weight given two of three vectors are unauthenticated.
Researcher Abhinav Agarwal reported all three vulnerabilities to CISA.
Published ·Deep Fathom