NextGen Healthcare Mirth Connect
CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.
CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.
- Three HIGH-severity flaws: CVE-2026-82583 SQL injection, CVE-2026-78224 and CVE-2026-82578 XXE
- SQL injection allows credential disclosure, arbitrary file write, and denial of service
- Affects Mirth Connect versions 4.7.1 and earlier, used worldwide in healthcare
- No public exploitation reported to CISA at this time
- Vendors
- NextGen Healthcare
- Products
- Mirth Connect
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78224+1 related CVE | XXE Injection in NextGen Healthcare Mirth Connect XSLT Transformer Step | 8.8 group max | — | ||
| CVE-2026-82583 | Authenticated SQL Injection in NextGen Connect (Mirth Connect) 4.7.1 and Earlier | 7.2 | — |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition. The following versions of NextGen Healthcare Mirth Connect are affected: Mirth Connect <=v4. 7.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.