CVE-2026-82578: NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NextGen Healthcare Mirth Connectto a version that resolves this vulnerability.Fixed in 4.7.2 - Configuration
Prevent XXE by disabling XML batch processing and/or not selecting the XPath option, since when XML batch processing is turned on and XPath is selected the raw batch input is processed without entity restrictions.
NextGen Healthcare Mirth Connect XML batch processing + XPath option = turn off XML batch processing or do not select the XPath option
Event History
Frequently Asked Questions
What configuration is required for this issue to be exploitable?
XML batch processing must be enabled and configured to use the XPath option. In that configuration, raw batch input is processed with a default XPath/JAXP setup that does not restrict XML entities.
What does an attacker need to exploit the vulnerability?
The issue is network-accessible, requires no privileges, and requires no user interaction. An attacker would need to submit crafted XML batch input to an affected configuration.
What impact can successful exploitation have?
Successful XXE injection can enable data exfiltration and denial-of-service attacks. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact in the vector.