NextGen's Mirth Connect Gets Three High-Severity Patches
Security / news
NextGen's Mirth Connect Gets Three High-Severity Patches
One of the three flaws needs no login at all, and a researcher found all three by running his own AI-assisted vulnerability-discovery methodology against the healthcare integration engine.
NextGen Healthcare has patched three high-severity vulnerabilities in Mirth Connect, the open-source-rooted engine hospitals use to route data between electronic health record systems, after a researcher found them by pointing autonomous AI agents at his own published vulnerability-discovery methodology.
The Cybersecurity and Infrastructure Security Agency published an advisory on the flaws Sept. 10, 2026, and HIPAA Journal reported the same day that all three affect Mirth Connect version 4.7.1 and earlier, with fixes shipping in version 4.7.2. Security researcher Abhinav Agarwal is credited with discovering all three, according to CISA and HIPAA Journal.
What an attacker with no login can already do
CVE-2026-78224, the most exposed of the three, needs no authentication at all: it lets an attacker exploit an improperly configured XSLT Transformer Step to trigger XML External Entity injection, which can disclose files on the server and exfiltrate data, CISA's advisory says. It carries a CVSS v3.1 score of 8.2 and a CVSS v4.0 score of 8.8, the higher of the two scales weighting its lack of any authentication requirement more heavily.
| CVE | Flaw | Requires Login | CVSS v3.1 |
|---|---|---|---|
| CVE-2026-82583 | SQL injection via Database Connector API | Yes | 8.3 |
| CVE-2026-78224 | XXE via XSLT Transformer Step | No | 8.2 |
| CVE-2026-82578 | XXE via XML batch processing with XPath | Yes | 7.5 |
CVE-2026-82583, the SQL injection flaw, requires an authenticated session but can then expose administrator password hashes, full channel definitions and complete server configurations through the Database Connector API, CISA's advisory says. CVE-2026-82578 needs XML batch processing with the XPath option enabled and can be used to exfiltrate data or trigger a denial-of-service condition, according to the advisory.
Why Agarwal calls it a switchboard
"Mirth Connect is effectively a switchboard between healthcare systems," Agarwal said, according to HIPAA Journal. "A vulnerability in the integration layer can expose much more than one isolated application." That framing matches what Mirth Connect actually does: it sits between electronic health record systems, labs and billing platforms, translating and routing messages rather than storing patient records itself, which is why a flaw in its connector code can reach further than a bug in any single downstream application.
The open-source version most administrators still expect
Mirth Connect's last fully open-source release was version 4.5.2, before NextGen Healthcare shifted the product to a commercial, proprietary licensing model, a change CISA's advisory does not flag but that complicates patching in practice: administrators who still run the old open-source branch, expecting it to behave like community-maintained software, may not realize a commercial version has since absorbed the security fixes they need. Neither CISA's advisory nor HIPAA Journal's report says how many hospitals or clinics are still running the pre-4.7.2 branch, which is the open question that determines how much of the exposure described in Adobe's Commerce zero-day patch or Forgejo's template RCE fix this month, this one actually shares: a fix that exists but has not yet reached everyone who needs it.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.