Which versions of Mirth Connect are affected by CVE-2026-82583?

NextGen Mirth Connect versions 4.7.1 and earlier allow low-privilege API users to extract administrator credentials and database passwords, which are then accessible to unauthenticated users via…

How to fix or mitigate CVE-2026-82583?

Within 24 hours: immediately identify all NextGen Mirth Connect deployments running version 4.7.1 or earlier and implement emergency network-level access restrictions on the Database Connector API endpoints, limiting to trusted internal administrators only; document systems and credential inventory that may be exposed; note that CISA advisory ICSMA-26-253-01 also covers related XXE vulnerabilities in the same product requiring concurrent remediation. Within 7 days: rotate all administrator passwords and database connector credentials with assumption of exposure; enable comprehensive audit logging on API access and configure monitoring for suspicious database query patterns; contact NextGen Healthcare support to request patch timelines and interim hardening guidance for versions 4.7.1 and earlier. Within 30 days: deploy Web Application Firewall rules to detect and block SQL injection payloads; implement network segmentation isolating Mirth Connect from untrusted networks; conduct forensic audit of accounts and systems potentially accessed with stolen credentials; establish secrets management to eliminate plaintext credential storage in configurations.

Mirth Connect CVE-2026-82583

Q: What is the CVSS score of CVE-2026-82583?

CVE-2026-82583 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-76115 HIGH

SQL Injection (CWE-89)

2026-09-11

GHSA-6886-6vr9-xwhr

SQLi

7.2

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

PR:L confirmed: authenticated API session required; C:H and A:H reflect credential export and Derby freeze; I:L for web-directory write.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 11, 2026 - 15:22 NVD

7.2 (HIGH)

Analysis Generated

Sep 11, 2026 - 14:18 vuln.today

CVE Published

Sep 11, 2026 - 13:08 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Authenticated SQL injection in NextGen Mirth Connect 4.7.1 and earlier allows a low-privilege API user to execute arbitrary SQL via the unsanitized selectLimit parameter in the Database Connector API (POST /api/connectors/jdbc/_getTables). Against the bundled Apache Derby database, this exports administrator password hashes and channel configuration containing plaintext connector credentials to a web-accessible path retrievable without authentication, and can freeze database-backed operations until server restart. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session to the Mirth Connect administrative API - specifically, an account with access to the Database Connector API endpoint POST /api/connectors/jdbc/_getTables. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H (8.3 High) correctly models the risk: network-reachable, no complexity barrier, but requiring a valid authenticated session (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	NextGen recommends upgrading to Mirth Connect 4.7.2 or later, which fixes CVE-2026-82583 and CVE-2026-82578; CVE-2026-78224 was already fixed in 4.7.1 per NextGen's coordination timeline. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: immediately identify all NextGen Mirth Connect deployments running version 4.7.1 or earlier and implement emergency network-level access restrictions on the Database Connector API endpoints, limiting to trusted internal administrators only; document systems and credential inventory that may be exposed; note that CISA advisory ICSMA-26-253-01 also covers related XXE vulnerabilities in the same product requiring concurrent remediation. …

Threat intelligence, references, and detailed analysis are available after sign-in.