CISA 2026-09-10

NextGen Healthcare Mirth Connect

Machine-generated analysis · WAYSCloud LLM

Mirth Connect versions up to 4.7.1 are vulnerable to SQL injection and XXE flaws. The advisory recommends updating to version 4.7.2 or later.

Context

NextGen Healthcare Mirth Connect versions <= v4.7.1 are listed as affected. The advisory states an authenticated user can execute arbitrary SQL via the Database Connector API and that an insecure XSLT Transformer can enable XXE attacks, both potentially leading to data exfiltration or denial-of-service. The vendor advises upgrading to Mirth Connect v4.7.2 or later.

Operator considerations

Check: inventory deployed Mirth Connect instances and verify their version.
Patch: upgrade any instance at or below v4.7.1 to v4.7.2 or later as per the vendor recommendation.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition.

The following versions of NextGen Healthcare Mirth Connect are affected:

Mirth Connect

Read the full advisory on CISA →