NextGen's Mirth Connect Gets Three High-Severity Patches

NextGen Healthcare has patched three high-severity vulnerabilities in Mirth Connect, the open-source-rooted engine hospitals use to route data between electronic health record systems, after a researcher found them by pointing autonomous AI agents at his own published vulnerability-discovery methodology.

The Cybersecurity and Infrastructure Security Agency published an advisory on the flaws Sept. 10, 2026, and HIPAA Journal reported the same day that all three affect Mirth Connect version 4.7.1 and earlier, with fixes shipping in version 4.7.2. Security researcher Abhinav Agarwal is credited with discovering all three, according to CISA and HIPAA Journal.

What an attacker with no login can already do

CVE-2026-78224, the most exposed of the three, needs no authentication at all: it lets an attacker exploit an improperly configured XSLT Transformer Step to trigger XML External Entity injection, which can disclose files on the server and exfiltrate data, CISA's advisory says. It carries a CVSS v3.1 score of 8.2 and a CVSS v4.0 score of 8.8, the higher of the two scales weighting its lack of any authentication requirement more heavily.

CVE	Flaw	Requires Login	CVSS v3.1
CVE-2026-82583	SQL injection via Database Connector API	Yes	8.3
CVE-2026-78224	XXE via XSLT Transformer Step	No	8.2
CVE-2026-82578	XXE via XML batch processing with XPath	Yes	7.5

CVE-2026-82583, the SQL injection flaw, requires an authenticated session but can then expose administrator password hashes, full channel definitions and complete server configurations through the Database Connector API, CISA's advisory says. CVE-2026-82578 needs XML batch processing with the XPath option enabled and can be used to exfiltrate data or trigger a denial-of-service condition, according to the advisory.

Why Agarwal calls it a switchboard

"Mirth Connect is effectively a switchboard between healthcare systems," Agarwal said, according to HIPAA Journal. "A vulnerability in the integration layer can expose much more than one isolated application." That framing matches what Mirth Connect actually does: it sits between electronic health record systems, labs and billing platforms, translating and routing messages rather than storing patient records itself, which is why a flaw in its connector code can reach further than a bug in any single downstream application.

The open-source version most administrators still expect

Mirth Connect's last fully open-source release was version 4.5.2, before NextGen Healthcare shifted the product to a commercial, proprietary licensing model, a change CISA's advisory does not flag but that complicates patching in practice: administrators who still run the old open-source branch, expecting it to behave like community-maintained software, may not realize a commercial version has since absorbed the security fixes they need. Neither CISA's advisory nor HIPAA Journal's report says how many hospitals or clinics are still running the pre-4.7.2 branch, which is the open question that determines how much of the exposure described in Adobe's Commerce zero-day patch or Forgejo's template RCE fix this month, this one actually shares: a fix that exists but has not yet reached everyone who needs it.