AI analysis
CVE-2026-82578 is an XML External Entity (XXE) injection flaw (CWE-611) in NextGen Healthcare's Mirth Connect integration engine: when a channel has XML batch processing enabled and the XPath option selected, raw batch input is parsed through a default XPath/JAXP configuration with no restrictions on external entities. An unauthenticated network attacker who can submit data to such a channel can supply crafted XML with external entity references, causing the parser to read local files or internal resources and disclose them, or to consume resources and cause denial of service. The CVSS 4.0 score of 8.7 (High) reflects a network-adjacent, unauthenticated attack with high confidentiality impact; given Mirth Connect's role as a healthcare integration engine, exfiltrated data may include patient or clinical messages passing through affected channels. Organizations running Mirth Connect with XML batch processing plus the XPath option are affected; those using other batch or message processing modes are not. No public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation have been reported as of this analysis.
What to do: Patch as soon as NextGen Healthcare publishes a fix for this CVE, and in the interim audit Mirth Connect channels to identify any with XML batch processing and the XPath option selected. Until patched, avoid or disable that batch/XPath combination, configure the JAXP/XPath parser to disallow external entities and DTDs where the platform permits, and restrict network access to exposed Mirth Connect channel endpoints to trusted systems only.
Affected
| NextGen Healthcare Mirth Connect | — |
Estimated exposure
moderateroughly 1,000-3,000 internet-exposed Mirth Connect servers, a subset of deployments at thousands of healthcare organizations — Public internet scans have historically shown on the order of a few thousand exposed Mirth Connect servers, and NextGen reports adoption across thousands of healthcare organizations, but this flaw additionally requires the non-default XML…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.