NextGen Healthcare Patches Three Flaws in Mirth Connect

An unauthenticated attacker can read files off a server running NextGen Healthcare's Mirth Connect, and an authenticated one can pull stored credentials for every system the integration engine talks to, according to a CISA advisory published Thursday.

The advisory, ICSMA-26-253-01, covers three vulnerabilities in Mirth Connect version 4.7.1 and earlier. NextGen Healthcare has shipped version 4.7.2 to fix all three, according to the same advisory.

What CVE-2026-82583 exposes

The most severe of the three, CVE-2026-82583, carries a CVSS 3.1 score of 8.3. It requires low-privilege authentication, but once an attacker has it, they can inject arbitrary SQL through Mirth Connect's Database Connector API. CISA says successful exploitation can disclose database and configuration data, expose stored credentials for every downstream system a Mirth channel connects to, allow arbitrary file writes, and trigger a denial-of-service condition.

The two bugs that skip authentication entirely

CVE-2026-78224 and CVE-2026-82578 both need no login. The first, rated 8.2 on CVSS 3.1, exists because Mirth Connect's XSLT Transformer Step builds a bare Java TransformerFactory without the security options that would stop it from resolving external entities, a classic XXE injection pattern that lets an unauthenticated sender read server-local files and stall the affected channel. The second, CVE-2026-82578, rated 7.5, is a related XXE flaw in XML batch processing with the same unauthenticated access.

CVE	CVSS 3.1	Authentication needed	Flaw type
CVE-2026-82583	8.3	Yes, low-privilege	SQL injection
CVE-2026-78224	8.2	None	XXE, file read
CVE-2026-82578	7.5	None	XXE, batch processing

Why an integration engine matters more than its name suggests

Mirth Connect is not a product most hospital staff have heard of, but it is the switchboard that moves data between clinical and billing systems. "Mirth Connect is effectively a switchboard between healthcare systems," Steve Alder, editor-in-chief of HIPAA Journal, wrote in reporting security researcher Abhinav Agarwal's findings, "so a vulnerability in the integration layer can expose much more than one isolated application." Alder also wrote that "a hospital may not see the name Mirth anywhere on the product it bought," which he said is why software bills of materials and exact version disclosure matter once flaws like these surface.

That visibility gap is also why this advisory sits alongside two other CISA advisories this month naming the exact model of satellite terminal exposed to the internet and an industrial VPN client CISA rated a 9.6: none of the three products are ones an end user would recognize by name, and all three needed a federal advisory to surface the version number that matters.

CISA's advisory does not say how many Mirth Connect deployments remain on 4.7.1 or earlier, and NextGen Healthcare has not published a count of affected customers. The fix is a version upgrade, not a configuration change, so exposure ends only when an operator actually installs 4.7.2.