Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
Mirth Connect is an integration engine widely used to move HL7 and other clinical messages between systems, including connected devices and SaMD back ends. CISA's advisory covers three vulnerabilities. CISA lists versions below 4.7.1 as affected, and its description covers 4.7.1 and earlier.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-78224 | The XSLT Transformer step is built without secure parser settings, so XML external entity (XXE) injection can exfiltrate data or cause a denial of service (CWE-611) | Information disclosure, Denial of service | High | High |
| CVE-2026-82578 | With XML batch processing on and the XPath option selected, batch input is parsed with no entity restrictions, so XXE injection can exfiltrate data or cause a denial of service (CWE-611) | Information disclosure, Denial of service | High | High |
| CVE-2026-82583 | An authenticated user can run arbitrary SQL through a Database Connector API, which could disclose stored credentials (CWE-89) | Information disclosure, Elevation of privilege | Medium | High |
The two XXE vectors are network-reachable with no privileges and no user action, so Exploitability reads High. The SQL injection needs a low-privilege login, so it reads Medium. On Blue Goat's security matrix, the two XXE flaws are Critical and the SQL injection is High, as published.
The published vectors describe the software, not your device. If the service is reachable only on a segmented clinical network or behind authentication, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
At High exploitability, for the two XXE flaws:
| Severity from your hazard analysis | Safety risk at High exploitability |
|---|---|
| Negligible | Medium |
| Minor or Serious | High |
| Critical or Catastrophic | Very High |
At Medium exploitability, for the SQL injection:
| Severity from your hazard analysis | Safety risk at Medium exploitability |
|---|---|
| Negligible | Low |
| Minor or Serious | Medium |
| Critical or Catastrophic | High |
An integration engine carries clinical messages between systems. Disclosed credentials, or a stalled engine, can expose patient data or stop results and orders from reaching the systems that need them.
What to check now
- Search your SBOM and your deployment for Mirth Connect 4.7.1 or earlier.
- Check whether your channels use the XSLT Transformer step, or XML batch processing with the XPath option.
- Update to Mirth Connect 4.7.2 or later, which NextGen recommends.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score each affected threat, and carry patient-harm results into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.