NextGen Healthcare Mirth Connect versions 4.7.1 and earlier contain three vulnerabilities that could let attackers extract data or disrupt service. NextGen recommends upgrading to version 4.7.2 or later, which the vendor identifies as the fix. The affected product is used in the healthcare and public health sector, and the advisory lists deployments worldwide. CISA’s advisory does not report known public exploitation specifically targeting these flaws.
The weaknesses affect different processing paths. One is an SQL injection issue that requires authentication. The other two are XML external entity, or XXE, flaws that can be reached without authentication under the conditions described by CISA. The advisory says exploitation could expose information, including credentials for connected systems, write files, or cause denial of service. It does not identify affected organizations, confirmed victims, or a known campaign using the vulnerabilities.
The SQL injection flaw is tracked as CVE-2026-82583. In Mirth Connect versions 4.7.1 and earlier, an authenticated user can send arbitrary SQL through the Database Connector API. The stated effects include disclosure of stored credentials for connected systems, arbitrary file writing, and denial of service. CISA assigns the flaw a CVSS 3.1 base score of 8.3, rated High. Its scoring vector gives the vulnerability network reachability, low attack complexity, and a requirement for low-level privileges, with no user interaction required.
That access requirement matters when assessing exposure. This is not described as an unauthenticated SQL injection path. An attacker would first need the required account access, but the advisory does not explain how such access might be obtained or whether deployments commonly expose the relevant API. The documented impact remains serious because credentials used by connected systems could be disclosed and because the flaw could permit arbitrary file writes or service disruption.
The first XML issue, CVE-2026-78224, involves the XSLT Transformer Step. CISA says the step creates a bare TransformerFactory without the security options needed to restrict external entities. An XXE payload can therefore lead to data exfiltration or denial of service. Unlike the SQL injection flaw, CISA’s CVSS vector for this vulnerability does not require privileges or user interaction. The advisory gives it a CVSS 3.1 score of 8.2, also rated High.
The second XML issue, CVE-2026-82578, applies when XML batch processing is enabled and the XPath option is selected. Under those conditions, raw batch input passes through a default XPath/JAXP setup without entity restrictions. CISA says an attacker can use XXE injection to exfiltrate data or cause denial of service. The flaw has a CVSS 3.1 score of 7.5, rated High, and its vector likewise describes a network-reachable path requiring no privileges or user interaction.
The mechanics differ, but the security concern is similar: application features that process database commands or XML input do not sufficiently constrain what the input can cause. The SQL flaw allows commands to reach the Database Connector API without adequate neutralization of special SQL elements. The XML flaws allow external entity behavior because the relevant Java XML processing configurations lack restrictions. CISA classifies the SQL issue under CWE-89 and both XML issues under CWE-611.
The practical remediation identified in the advisory is the same for all three vulnerabilities: upgrade Mirth Connect to version 4.7.2 or later. NextGen directs users to obtain the latest version through its customer portal. The advisory does not provide a separate workaround for organizations that cannot upgrade, and it does not describe the specific code changes included in version 4.7.2.
CISA also recommends reducing network exposure, keeping control-system devices and related systems off the public internet, placing them behind firewalls, and isolating them from business networks. Where remote access is necessary, the agency recommends more secure methods such as updated virtual private networks, while noting that VPN security depends on the connected devices. It advises organizations to conduct impact analysis and risk assessment before deploying defensive measures.
What is known is that CISA lists versions 4.7.1 and earlier as affected, identifies three vulnerability paths, rates each one High under CVSS 3.1, and records a vendor-recommended fix at version 4.7.2 or later. What remains unknown from the advisory is whether any of the vulnerabilities has been exploited in a real-world incident, how many deployments run an affected version, and whether a particular configuration is more common among exposed installations. CISA explicitly says that no known public exploitation specifically targeting these vulnerabilities had been reported to the agency at the time of the advisory’s initial publication on September 10, 2026. No dispute over the technical findings is identified in the advisory; the unresolved issue is the extent of real-world exposure and exploitation.