CVE-2026-82583

High8.3Published on September 11, 2026

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

CVSS score8.3 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Weakness type (CWE)CWE-89

Vulnerabilities

Three High-Severity Flaws Expose NextGen Mirth Connect Data and Credentials

CISA discloses three high-severity Mirth Connect flaws through 4.7.1, with SQL injection and XXE risking data theft and credential exposure.

Sep 11, 202605:125 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Three High-Severity Flaws Expose NextGen Mirth Connect Data and Credentials