CISA flags SQL injection and XXE flaws in NextGen Healthcare Mirth Connect (ICSMA-26-253-01)

CVE-2026-78224 is an XML External Entity (XXE) injection flaw (CWE-611) in the XSLT Transformer step of NextGen Healthcare's Mirth Connect integration engine, where the step builds a bare TransformerFactory without the security options that restrict external entities and DTDs. It is triggered when a channel's XSLT Transformer step parses attacker-influenced XML; the CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates a remote, unauthenticated attacker with no user interaction can reach the vulnerable processing. Successful exploitation yields a high confidentiality impact (local file disclosure and data exfiltration via external entity resolution) plus a limited availability impact from denial-of-service, with no scored integrity impact. Only Mirth Connect deployments whose channels use the XSLT Transformer step with attacker-reachable input are exploitable, and the available data does not specify affected or fixed version numbers. The issue was assigned by CISA ICS-CERT and disclosed alongside CVE-2026-82583 (SQL injection) and CVE-2026-82578 in NextGen Mirth Connect; it is not in CISA KEV and no public proof-of-concept is known.

Do: Apply the NextGen Healthcare Mirth Connect patch announced for this advisory once identified (no fixed version is given in the available data), prioritizing instances whose Mirth Connect listener ports are internet-exposed and channels that use the XSLT Transformer step. As interim mitigation, restrict network access to Mirth Connect interfaces and ensure XML parsing in the XSLT Transformer step disables external entities and DTDs. Also review your environment for the companion issues CVE-2026-82583 (SQL injection) and CVE-2026-82578 when planning the same update window.

CVE-2026-82578 is an XML External Entity (XXE) injection flaw (CWE-611) in NextGen Healthcare's Mirth Connect integration engine: when a channel has XML batch processing enabled and the XPath option selected, raw batch input is parsed through a default XPath/JAXP configuration with no restrictions on external entities. An unauthenticated network attacker who can submit data to such a channel can supply crafted XML with external entity references, causing the parser to read local files or internal resources and disclose them, or to consume resources and cause denial of service. The CVSS 4.0 score of 8.7 (High) reflects a network-adjacent, unauthenticated attack with high confidentiality impact; given Mirth Connect's role as a healthcare integration engine, exfiltrated data may include patient or clinical messages passing through affected channels. Organizations running Mirth Connect with XML batch processing plus the XPath option are affected; those using other batch or message processing modes are not. No public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation have been reported as of this analysis.

Do: Patch as soon as NextGen Healthcare publishes a fix for this CVE, and in the interim audit Mirth Connect channels to identify any with XML batch processing and the XPath option selected. Until patched, avoid or disable that batch/XPath combination, configure the JAXP/XPath parser to disallow external entities and DTDs where the platform permits, and restrict network access to exposed Mirth Connect channel endpoints to trusted systems only.

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier contain a SQL injection flaw (CWE-89) in the Database Connector API. An attacker needs valid credentials but no elevated privileges or user interaction: an authenticated user can send crafted input to the connector API to execute arbitrary SQL against the underlying database. Successful exploitation can disclose credentials stored in Mirth Connect for connected downstream systems, write arbitrary files on the host (which could enable further compromise), and cause a denial-of-service condition. Any organization running NextGen Connect 4.7.1 or earlier — most commonly hospitals and health systems using it as an HL7/healthcare integration engine — is affected. As of now the flaw is not in the CISA KEV, no public proof-of-concept is known, and there are no reports of in-the-wild exploitation.

Do: Upgrade NextGen Connect to a release later than 4.7.1 per NextGen Healthcare's security advisory. Until patched, restrict which authenticated accounts can reach the Database Connector API, ensure the connector's database account has least-privilege rights (limiting file-write and credential access), and avoid exposing the API to the internet. Review logs for unexpected SQL or file-write activity from user accounts, and rotate credentials stored in Mirth Connect for connected systems if compromise is suspected.