CVE-2026-82578

NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

Affected

NextGen Healthcare · Mirth Connect

CVSS v4.0 HQ

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 HQ

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-09-11

Proof-of-concept exploits (1)

• abhinavagarwal07/mirth-connect-security-poc0★ · 2026-09-10

References

• CVE Record
• NVD entry

Related

• CVE-2026-78224
• CVE-2026-82583