NextGen Connect Vulnerabilities Threaten Healthcare Data Security
Three high-severity flaws in NextGen Connect could expose administrator credentials, leading to unauthorized access to sensitive hospital systems and patient data.
NextGen Healthcare's Mirth Connect integration engine, a critical tool used globally for exchanging medical data, is affected by a trio of high-severity vulnerabilities discovered by independent researcher Abhinav Agarwal. These flaws, found in version 4.5.2, the last open-source release before the company transitioned to a proprietary model, could allow attackers to steal credentials for downstream hospital systems, including databases and clinical endpoints, posing a significant risk to healthcare data security.
The vulnerabilities, now cataloged by CISA and added to its Known Exploited Vulnerabilities (KEV) list, include an authenticated SQL injection flaw (CVE-2026-82583) and two unsafe XML parser vulnerabilities (CVE-2026-78224 and CVE-2026-82578). The SQL injection flaw can expose administrator password hashes, channel definitions, and server configurations. Critically, Mirth Connect 4.5.2 stores connector passwords in plain text, making them easily accessible to attackers who can then leverage these credentials to access connected databases, file servers, mail relays, and clinical systems.
Adding to the severity, the sensitive information is written to a directory served over HTTP without any authentication, allowing attackers to exfiltrate this data without needing any prior account access. Agarwal noted that the same malicious request used for data exfiltration can also freeze the bundled database, forcing a server restart for recovery. The flaw resides in the Database Connector endpoint, which fails to properly sanitize user input for the selectLimit parameter, allowing authenticated users to manipulate queries against the Mirth platform's Apache Derby database.
The two XML parser vulnerabilities, CVE-2026-78224 and CVE-2026-78224, can be exploited by unauthenticated attackers. These flaws affect channels that process incoming messages. By sending a specially crafted malicious message, an attacker can exploit these vulnerabilities to read files from the server. This is achieved through XML external entity (XXE) attacks, allowing the attacker to redirect the contents of server-readable files to an address they control.
NextGen Healthcare has addressed these issues by releasing fixes in version 4.7.2. However, Agarwal pointed out that while customers can obtain patches for the commercial builds, the vulnerable open-source version 4.5.2 remains publicly available, and the patches are not inspectable by external parties. The company's prompt response was likely influenced by previous security incidents involving Mirth Connect, including a deserialization flaw (CVE-2023-43208) exploited in 2024 due to an incomplete patch for an earlier vulnerability (CVE-2023-37679).
This discovery comes at a time when healthcare organizations are under increasing scrutiny for their data security practices. NextGen Healthcare itself faced a significant data breach in 2023 that exposed the data of approximately one million individuals, resulting in a $19.4 million settlement finalized in March. The ongoing threat landscape, coupled with the critical nature of healthcare data, underscores the importance of timely patching and robust security measures for systems like Mirth Connect.
The exploitation of these vulnerabilities could have far-reaching consequences, potentially leading to the compromise of electronic health records, disruption of clinical operations, and significant regulatory penalties for healthcare providers. The fact that some of these flaws are exploitable without authentication further heightens the risk, as it lowers the barrier to entry for malicious actors seeking to access sensitive patient information.
CISA has issued an advisory detailing three critical vulnerabilities in NextGen Healthcare Mirth Connect, specifically affecting versions prior to v4.7.2. These flaws, identified as CVE-2026-82583, CVE-2026-78224, and CVE-2026-82578, enable SQL injection and XML External Entity (XXE) injection attacks. Successful exploitation could lead to sensitive data exfiltration, disclosure of stored credentials, arbitrary file writes, and denial-of-service conditions, with CVSS scores ranging from 7.2 to 8.3.