Bankinfosecurity NextGen Mirth Connect Vulnerabilities Expose Healthcare Systems
Article Content
- •Critical vulnerabilities in Mirth Connect expose healthcare systems to data breaches.
- •Affected versions include Mirth Connect 4.7.1 and earlier; users must upgrade to 4.7.2.
- •Exploitation could lead to unauthorized access to sensitive healthcare data and denial-of-service.
NextGen Healthcare's Mirth Connect integration engine has critical vulnerabilities that allow attackers to exfiltrate sensitive data and potentially disrupt services. The flaws include an authenticated SQL injection (CVE-2026-82583) and two XML parser vulnerabilities (CVE-2026-78224, CVE-2026-82578), all rated with CVSS scores between 7 and 8. These vulnerabilities could enable unauthorized access to administrator passwords and downstream systems, affecting healthcare organizations globally. The issues were reported by researcher Abhinav Agarwal and have been patched in version 4.7.2, released on August 5, 2026. Users are urged to update immediately to mitigate risks. The vulnerabilities impact Mirth Connect versions 4.7.1 and earlier, which are widely used in the healthcare sector for data exchange.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track NextGen Healthcare and CVE-2023-37679 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
China-Linked Hackers Exploit PHP2Shell to Root 25 Servers Cybersecurity firm Dream reported that a China-linked threat actor exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300) to gain root access to 25 servers, including three in a U.S. government-affiliated environment. The attackers used… 
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…