CISA Warns of Critical SQL Injection and XXE Vulnerabilities in NextGen Healthcare Mirth Connect

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems (ICS) advisory, ICSMA-26-253-01, disclosing three vulnerabilities in NextGen Healthcare Mirth Connect, a widely used integration engine in healthcare and public health environments. The vulnerabilities were reported to CISA by researcher Abhinav Agarwal.

CVE-2026-82583 (CVSS 3.1: 8.3/HIGH; CVSS 4.0: 7.2/HIGH) is an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) in the Database Connector API. Exploitation requires authenticated access but could result in disclosure of stored credentials for connected systems, arbitrary file writes, and denial-of-service.

CVE-2026-78224 (CVSS 3.1: 8.2/HIGH; CVSS 4.0: 8.8/HIGH) stems from the XSLT Transformer Step building a bare TransformerFactory without proper security options. This Allows XXE injection, enabling data exfiltration and denial-of-service attacks.

CVE-2026-82578 (CVSS 3.1: 7.5/HIGH; CVSS 4.0: 8.7/HIGH) occurs when XML batch processing with the XPath option is enabled. The raw batch input passes through a default XPath/JAXP setup without entity restrictions, again allowing XXE injection for data exfiltration and denial-of-service.

All three vulnerabilities affect NextGen Healthcare Mirth Connect versions 4.7.1 and earlier. The vendor has released Mirth Connect v4.7.2 as a remediation, available via the NextGen Healthcare customer portal. CISA recommends that organizations minimize network exposure, isolate control system networks behind firewalls, and use VPNs for remote access where required. No public exploitation of these flaws has been reported as of the advisory publication date.