Description
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NextGen Healthcare | Mirth Connect | ≤ 4.7.1 | 4.7.2 |
Advisories 1
- ICSMA-26-253-01 NextGen Healthcare Mirth Connect CISA ICS & IT advisories · Sep 10, 2026