CVE-2026-82578

CVE-2026-82578 is an XML External Entity (XXE) injection flaw (CWE-611) in NextGen Healthcare's Mirth Connect integration engine: when a channel has XML batch processing enabled and the XPath option selected, raw batch input is parsed through a default XPath/JAXP configuration with no restrictions on external entities. An unauthenticated network attacker who can submit data to such a channel can supply crafted XML with external entity references, causing the parser to read local files or internal resources and disclose them, or to consume resources and cause denial of service. The CVSS 4.0 score of 8.7 (High) reflects a network-adjacent, unauthenticated attack with high confidentiality impact; given Mirth Connect's role as a healthcare integration engine, exfiltrated data may include patient or clinical messages passing through affected channels. Organizations running Mirth Connect with XML batch processing plus the XPath option are affected; those using other batch or message processing modes are not. No public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation have been reported as of this analysis.

What to do: Patch as soon as NextGen Healthcare publishes a fix for this CVE, and in the interim audit Mirth Connect channels to identify any with XML batch processing and the XPath option selected. Until patched, avoid or disable that batch/XPath combination, configure the JAXP/XPath parser to disallow external entities and DTDs where the platform permits, and restrict network access to exposed Mirth Connect channel endpoints to trusted systems only.