Three High Severity Flaws Hit NextGen Healthcare's Mirth Connect

MedDevice Cyber Staff · 6 days ago · 3 min read · Via CISA ICSMA-26-253-01

CISA published ICSMA-26-253-01 on September 10, naming three high severity vulnerabilities in NextGen Healthcare's Mirth Connect integration engine. All three carry CVSS v3.1 scores of 7.5 or higher, and each lands in versions 4.7.1 and earlier. NextGen fixed the set in Mirth Connect 4.7.2, distributed through its customer portal.

The worst of the three is CVE-2026-82583, a SQL injection in the Database Connector API scored 8.3. An authenticated user can run arbitrary SQL through the connector, which CISA says can expose stored credentials for every system Mirth Connect talks to, write arbitrary files, or knock the database offline. Mirth Connect exists to move patient data between systems, so a hole in its own connector layer reaches every integration built on top of it.

The other two are XML external entity flaws. CVE-2026-78224, scored 8.2, sits in the XSLT Transformer Step, which builds a bare TransformerFactory without the security options that would block external entity references. CVE-2026-82578, scored 7.5, is the same class of bug in XML batch processing when the XPath option is turned on: raw batch input hits the parser with no entity restrictions. Both let an attacker pull files off the server or exhaust it with a crafted payload.

Researcher Abhinav Agarwal reported all three to CISA. There is no indication of active exploitation yet, unlike the Mirth Connect remote code execution flaw CISA flagged as under attack in 2024. That history is why this advisory deserves faster attention than its CVSS scores alone suggest: a widely deployed interface engine that has already drawn ransomware crews once is not a theoretical target the second time.

Mirth Connect runs inside thousands of hospital networks as the plumbing between EHRs, labs, and devices, usually with broad database and file system access to do that job. Patch to 4.7.2 and audit who can authenticate to the Database Connector API in the meantime; the SQL injection requires a login, but it does not require a privileged one.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Mirth Connect to 4.7.2 through the NextGen Healthcare customer portal; the release fixes all three CVEs in this advisory. Until the update is deployed, restrict who can authenticate to the Database Connector API and review credentials Mirth Connect stores for connected systems, since CVE-2026-82583 lets any authenticated user reach them. Disable or lock down the XSLT Transformer Step and XML batch processing with XPath if they are not in active use.

Update to Mirth Connect 4.7.2. Pull the release from the NextGen Healthcare customer portal; it fixes CVE-2026-82583, CVE-2026-78224, and CVE-2026-82578.
Restrict Database Connector API access. Limit which authenticated accounts can reach the connector until the update is deployed; the SQL injection needs only a login, not an admin one.
Rotate credentials stored for connected systems. Treat any credential Mirth Connect held for downstream systems as potentially exposed and rotate it after patching.
Turn off XML external entity resolution by default. Configure the XSLT Transformer and XML batch parsers to reject external entities and DTDs regardless of channel settings.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

data_phi

Contributing

sys_ots_software net_remote_access app_user_accounts app_database parse_hl7 use_hospital_net net_cloud

EMB3D

PID-311

Fix the class in your product

Input reaches the database as query text. As the maker, parameterize every query so input is never concatenated into SQL, run on a least-privilege database account, and enforce it with a static-analysis gate so a concatenated query fails the build.

Parameterize every query. No exceptions for internal or trusted callers; bind inputs, never build statement text from them.
Least-privilege the database role. The app account cannot alter schema or reach unrelated tables.
Gate it in CI/CD. Static analysis fails a build that concatenates a query.

Mapped EMB3D mitigations

Questions & Answers

What CVEs are in CISA advisory ICSMA-26-253-01 for NextGen Healthcare Mirth Connect?

ICSMA-26-253-01, published September 10, 2026, covers CVE-2026-82583 (SQL injection, CVSS 8.3), CVE-2026-78224 (XXE in the XSLT Transformer Step, CVSS 8.2), and CVE-2026-82578 (XXE in XML batch processing, CVSS 7.5). All three affect Mirth Connect 4.7.1 and earlier.

Is there a patch for the Mirth Connect SQL injection vulnerability CVE-2026-82583?

Yes. NextGen Healthcare fixed CVE-2026-82583 and two related XXE flaws in Mirth Connect 4.7.2, available through the NextGen Healthcare customer portal.

Who reported the Mirth Connect vulnerabilities to CISA?

Researcher Abhinav Agarwal reported all three vulnerabilities, CVE-2026-82583, CVE-2026-78224, and CVE-2026-82578, to CISA.

← Back to Vulnerabilities