CVE-2026-82583: NextGen Healthcare Mirth Connect SQL Injection
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NextGen Mirth Connectto a version that resolves this vulnerability.Fixed in 4.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to use the Database Connector API. The provided information does not indicate that unauthenticated users can exploit it.
Which deployments should be considered affected?
NextGen Connect (Mirth Connect) version 4.7.1 and earlier are affected according to the advisory data. The information provided does not identify configuration-specific prerequisites or exclusions.
What could an attacker do after exploiting the flaw?
The attacker could execute arbitrary SQL through the Database Connector API. Reported impacts include disclosure of stored credentials for connected systems, arbitrary file write, and denial of service.