Three high-severity vulnerabilities have been identified in NextGen Healthcare's Mirth Connect, the cross-platform integration engine that connects, routes, transforms and exchanges clinical and administrative data between healthcare systems. All three affect v4.7.1 and earlier and are fixed in v4.7.2, which NextGen has told customers to deploy as soon as possible.
| Attribute | Detail |
|---|---|
| CVEs | CVE-2026-82583 (CVSS 8.3), CVE-2026-78224 (CVSS 8.2), CVE-2026-82578 (CVSS 7.5) |
| Type | SQL injection via Database Connector API; XXE injection ×2 |
| Affected | Mirth Connect v4.7.1 and earlier |
| Fixed | Mirth Connect v4.7.2 |
| Reported by | Abhinav Agarwal |
| Reported | 2026-09-10 |
CVE-2026-82583 allows an authenticated user to execute arbitrary SQL through the Database Connector API, risking disclosure of database and configuration data and of stored credentials for connected systems, arbitrary file write and denial of service. CVE-2026-78224 arises from the XSLT Transformer Step building a bare TransformerFactory without security options, and CVE-2026-82578 from XML batch processing with the XPath option selected passing raw input through a default XPath/JAXP setup with no entity restrictions; both allow unauthenticated senders to read server-local files and stall channels.
The reporting researcher highlighted the supply-chain visibility problem specific to integration software: a hospital may never see the name Mirth on the product it bought, because integration engines are frequently embedded, resold or managed inside another vendor's offering, making SBOMs and exact version disclosure the only reliable way to establish exposure. See cve-2026-82583.md, cve-2026-78224.md and cve-2026-82578.md.