CVE-2026-78224

High8.2Published on September 11, 2026

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

CVSS score8.2 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness type (CWE)CWE-611

Vulnerabilities

Three High-Severity Flaws Expose NextGen Mirth Connect Data and Credentials

CISA discloses three high-severity Mirth Connect flaws through 4.7.1, with SQL injection and XXE risking data theft and credential exposure.

Sep 11, 202605:125 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Three High-Severity Flaws Expose NextGen Mirth Connect Data and Credentials