NextGen Healthcare Mirth Connect Multiple Vulnerabilities (SQL Injection & XXE)

Technical Analysis

CVE-2026-82583 (CVSS 3.1: 8.3) allows an authenticated user to execute arbitrary SQL via the Database Connector API, potentially disclosing stored credentials for connected systems, enabling arbitrary file write, and causing denial-of-service (CWE-89). CVE-2026-78224 (CVSS 3.1: 8.2) stems from the XSLT Transformer Step constructing a TransformerFactory without secure XML processing settings, enabling XXE-based data exfiltration and DoS (CWE-611). CVE-2026-82578 (CVSS 3.1: 7.5) arises from unrestricted XPath/JAXP configuration during XML batch processing, similarly enabling XXE attacks (CWE-611). All three are remotely exploitable over the network with low attack complexity; the SQL injection requires low-privilege authentication while the XXE flaws require no privileges. Because Mirth Connect is frequently used as a middleware/integration engine that feeds structured clinical data into downstream systems—including RAG pipelines and AI-driven clinical decision support or agentic healthcare automation tools—compromise of stored credentials or exfiltrated data via these flaws could poison or leak data consumed by AI agents integrated with the platform, making this agent-relevant for healthcare organizations running LLM-based tooling atop Mirth Connect data feeds.

Affected Systems

NextGen Healthcare Mirth Connect versions <=4.7.1, including Database Connector API, XSLT Transformer Step, and XML batch processing with XPath option enabled

Indicators of Compromise

• No specific IOCs published; no known public exploitation reported at this time

Remediation Steps

1. 1

   Upgrade Mirth Connect

   Update to Mirth Connect v4.7.2 or later, available via the NextGen Healthcare customer portal.

2. 2

   Restrict network exposure

   Ensure Mirth Connect instances and control system devices are not directly accessible from the internet; place behind firewalls and segment from business networks.

3. 3

   Harden authentication and access controls

   Limit and monitor authenticated users with access to the Database Connector API to reduce SQL injection risk.

4. 4

   Secure remote access

   Use VPNs or other secure remote access methods, keeping VPN software patched and monitored.

5. 5

   Disable or restrict XML external entity processing

   Where patching is delayed, review XSLT Transformer and XML batch/XPath configurations to disable external entity resolution as a compensating control.

6. 6

   Monitor and report

   Watch for anomalous SQL queries, XML processing errors, or unusual outbound network requests indicative of XXE exploitation, and report suspected activity to CISA.