Which versions of NextGen Mirth Connect are affected by CVE-2026-78224?

NextGen Mirth Connect versions 4.7.1 and earlier contain an XML injection vulnerability that allows unauthenticated attackers to steal sensitive server data and disable message processing channels.

How to fix or mitigate CVE-2026-78224?

Within 24 hours, identify all systems running NextGen Mirth Connect versions 4.7.1 or earlier and document their location and business criticality. Within 7 days, upgrade all affected instances to version 4.7.2 or later, following the vendor's upgrade guidance and testing patches in non-production environments first. Within 30 days, complete the production upgrade rollout, validate all XSLT Transformer Steps are functional post-upgrade, and review system logs for indicators of exploitation attempts such as unusual file access patterns or outbound HTTP connections from Mirth processes.

NextGen Mirth Connect CVE-2026-78224

Q: What is the CVSS score of CVE-2026-78224?

CVE-2026-78224 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-76116 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-09-11

GHSA-p85c-j652-88pj

XXE

8.8

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

PR:N confirmed by unauthenticated message delivery; A:L because DoS is channel-scoped not server-wide; C:H for arbitrary local file read via OOB exfiltration.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 11, 2026 - 15:22 NVD

8.8 (HIGH)

Analysis Generated

Sep 11, 2026 - 14:18 vuln.today

CVE Published

Sep 11, 2026 - 13:08 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

XXE injection via the XSLT Transformer Step in NextGen Mirth Connect (versions ≤4.7.1) allows unauthenticated network attackers to exfiltrate arbitrary server-local files through an out-of-band HTTP callback, and to deny service to the targeted processing channel. The root cause is a bare Java TransformerFactory instantiated without disabling external entity resolution (CWE-611). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires at least one Mirth Connect channel configured with an XSLT Transformer Step that is reachable from the attacker's network position. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 3.1 scores this 8.2 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting unauthenticated network exploitation with high confidentiality and limited availability impact; CVSS 4.0 scores it 8.8 High per the partial CISA vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to NextGen Mirth Connect version 4.7.2 or later, as recommended by CISA in ICSMA-26-253-01 and confirmed by NextGen Healthcare; downloads are available through the NextGen Healthcare customer portal. … Detailed patch versions, workarounds, and compensating controls in full report.