Mirth Connect

Related CVEsby mentions

• CVE-2026-782248.8—
  XXE Injection in NextGen Healthcare Mirth Connect XSLT Transformer Step
  CVE-2026-78224 is an XML External Entity (XXE) injection flaw (CWE-611) in the XSLT Transformer step of NextGen Healthcare's Mirth Connect integration engine, where the step builds a bare TransformerFactory without the security options that restrict external entities and DTDs. It is triggered when a channel's XSLT Transformer step parses attacker-influenced XML; the CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates a remote, unauthenticated attacker with no user interaction can reach the vulnerable processing. Successful exploitation yields a high confidentiality impact (local file disclosure and data exfiltration via external entity resolution) plus a limited availability impact from denial-of-service, with no scored integrity impact. Only Mirth Connect deployments whose channels use the XSLT Transformer step with attacker-reachable input are exploitable, and the available data does not specify affected or fixed version numbers. The issue was assigned by CISA ICS-CERT and disclosed alongside CVE-2026-82583 (SQL injection) and CVE-2026-82578 in NextGen Mirth Connect; it is not in CISA KEV and no public proof-of-concept is known.
  · NextGen Healthcare Mirth Connectlarge
• CVE-2026-825788.7—
  Unauthenticated XXE in NextGen Mirth Connect XML Batch Processing
  CVE-2026-82578 is an XML External Entity (XXE) injection flaw (CWE-611) in NextGen Healthcare's Mirth Connect integration engine: when a channel has XML batch processing enabled and the XPath option selected, raw batch input is parsed through a default XPath/JAXP configuration with no restrictions on external entities. An unauthenticated network attacker who can submit data to such a channel can supply crafted XML with external entity references, causing the parser to read local files or internal resources and disclose them, or to consume resources and cause denial of service. The CVSS 4.0 score of 8.7 (High) reflects a network-adjacent, unauthenticated attack with high confidentiality impact; given Mirth Connect's role as a healthcare integration engine, exfiltrated data may include patient or clinical messages passing through affected channels. Organizations running Mirth Connect with XML batch processing plus the XPath option are affected; those using other batch or message processing modes are not. No public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation have been reported as of this analysis.
  · NextGen Healthcare Mirth Connectmoderate
• CVE-2026-825837.2—
  Authenticated SQL Injection in NextGen Connect (Mirth Connect) 4.7.1 and Earlier
  NextGen Connect (Mirth Connect) versions 4.7.1 and earlier contain a SQL injection flaw (CWE-89) in the Database Connector API. An attacker needs valid credentials but no elevated privileges or user interaction: an authenticated user can send crafted input to the connector API to execute arbitrary SQL against the underlying database. Successful exploitation can disclose credentials stored in Mirth Connect for connected downstream systems, write arbitrary files on the host (which could enable further compromise), and cause a denial-of-service condition. Any organization running NextGen Connect 4.7.1 or earlier — most commonly hospitals and health systems using it as an HL7/healthcare integration engine — is affected. As of now the flaw is not in the CISA KEV, no public proof-of-concept is known, and there are no reports of in-the-wild exploitation.
  · NextGen Healthcare NextGen Connect (Mirth Connect) 4.7.1 and earliermoderate

Appears with