CVE-2026-82578

High7.5Published on September 11, 2026

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-611

Vulnerabilities

Three High-Severity Flaws Expose NextGen Mirth Connect Data and Credentials

CISA discloses three high-severity Mirth Connect flaws through 4.7.1, with SQL injection and XXE risking data theft and credential exposure.

Sep 11, 202605:125 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Three High-Severity Flaws Expose NextGen Mirth Connect Data and Credentials