Skip to content
OpenAdvisories
High ICSMA-26-253-01 3 CVEs

NextGen Healthcare Mirth Connect

Published Sep 10, 2026 · Updated Sep 10, 2026

Vendor: NextGen Healthcare Product: Mirth Connect

Summary

Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition.

Vulnerabilities 3

  • High 8.3
    CVE-2026-82583

    NextGen Healthcare Mirth Connect SQL Injection

    NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-…

    NextGen Healthcare Mirth Connect
  • High 8.2
    CVE-2026-78224

    NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

    The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

    NextGen Healthcare Mirth Connect
  • High 7.5
    CVE-2026-82578

    NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

    When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

    NextGen Healthcare Mirth Connect

Revision history

  1. #1

    Initial Publication

References