Critical SQL Injection and XML External Entity Flaws in NextGen Healthcare Mirth Connect (CVE‑2026‑82583, CVE‑2026‑78224, CVE‑2026‑82578)
What It Is — Three separate vulnerabilities have been disclosed in NextGen Healthcare Mirth Connect ≤ v4.7.1. Two are SQL‑injection flaws in the Database Connector API that allow an authenticated user to run arbitrary queries, read stored credentials, write files, or trigger a denial‑of‑service. The third is an XML External Entity (XXE) issue that can be abused to read arbitrary files on the server or cause service disruption.
Exploitability — All three CVEs have a CVSS v3 base score of 8.3 (High). Exploits require a valid user account on the integration engine, but many deployments expose Mirth Connect to internal users or service accounts that may be compromised through credential‑theft or lateral movement. Public PoCs have not been released, but the attack path is straightforward once authentication is obtained.
Affected Products — NextGen Healthcare Mirth Connect versions 4.7.1 and earlier.
Why It Matters for Trust & Control Assurance
- Patch Management & Vulnerability Remediation – The flaws test the control objective of maintaining up‑to‑date software and promptly applying vendor fixes, a requirement echoed across NIST CSF, ISO 27001, and HIPAA security rules.
- Evidence of Due Diligence – Demonstrating that you have a continuous inventory, automated patch tracking, and verifiable remediation evidence is increasingly demanded by healthcare partners and regulators.
- Defensible Audit Trail – If an incident occurs, auditors will look for documented processes that identified the vulnerability, recorded the remediation timeline, and captured proof that the fix was applied across all environments.
Recommended Actions
- Upgrade Mirth Connect to version 4.7.2 or later immediately.
- Verify that all instances are included in your software‑asset inventory and that the version field is being monitored by your configuration‑management database (CMDB).
- Capture remediation evidence (patch version, deployment timestamp, verification logs) and store it in a centralized Trust Center for audit readiness.
- Review authentication controls for any service accounts that access Mirth Connect and enforce least‑privilege principles.
Source: CISA Advisory – ICSMA‑26‑253‑01