CVE-2026-82583

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier contain a SQL injection flaw (CWE-89) in the Database Connector API. An attacker needs valid credentials but no elevated privileges or user interaction: an authenticated user can send crafted input to the connector API to execute arbitrary SQL against the underlying database. Successful exploitation can disclose credentials stored in Mirth Connect for connected downstream systems, write arbitrary files on the host (which could enable further compromise), and cause a denial-of-service condition. Any organization running NextGen Connect 4.7.1 or earlier — most commonly hospitals and health systems using it as an HL7/healthcare integration engine — is affected. As of now the flaw is not in the CISA KEV, no public proof-of-concept is known, and there are no reports of in-the-wild exploitation.

What to do: Upgrade NextGen Connect to a release later than 4.7.1 per NextGen Healthcare's security advisory. Until patched, restrict which authenticated accounts can reach the Database Connector API, ensure the connector's database account has least-privilege rights (limiting file-write and credential access), and avoid exposing the API to the internet. Review logs for unexpected SQL or file-write activity from user accounts, and rotate credentials stored in Mirth Connect for connected systems if compromise is suspected.