Which versions of Mirth Connect are affected by EUVD-2026-76117?

NextGen Mirth Connect, a critical healthcare data integration platform used to exchange patient information across clinical systems, is vulnerable to unauthenticated XML injection attacks that allow…

How to fix or mitigate EUVD-2026-76117?

Within 24 hours: Identify all Mirth Connect deployments in use and determine which instances have XPath batch XML processing enabled; assess network accessibility and data sensitivity of affected systems. Within 7 days: Either disable XPath batch processing functionality if clinically feasible, or immediately implement network-level access restrictions limiting Mirth Connect connectivity to authorized internal systems only; enable detailed audit logging of all XML operations and file access to establish a forensic baseline. Within 30 days: Contact the vendor for patch availability and release timelines; evaluate alternative healthcare data integration solutions that do not expose XXE risks; conduct a historical log review to identify any indicators of prior exploitation attempts.

Mirth Connect EUVD-2026-76117

Q: What is the CVSS score of EUVD-2026-76117?

EUVD-2026-76117 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-82578 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-09-11

GHSA-57hc-mr64-vrxx

XXE

8.7

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable, no auth per CVSS 4.0; C:H for file exfiltration; A:L added since description explicitly states DoS is achievable despite VA:N in provided vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 11, 2026 - 15:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 11, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Sep 11, 2026 - 15:22 NVD

8.7 (HIGH)

Analysis Generated

Sep 11, 2026 - 14:18 vuln.today

CVE Published

Sep 11, 2026 - 13:08 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

XXE injection in NextGen Mirth Connect allows unauthenticated remote attackers to exfiltrate arbitrary files from the server and trigger denial-of-service conditions when XML batch processing is enabled with the XPath option selected. The vulnerability stems from the absence of entity restrictions in the default XPath/JAXP XML parser configuration, permitting malicious external entity declarations to be resolved. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	XML batch processing must be enabled on a Mirth Connect channel AND the XPath message processing option must be specifically selected for that channel - both conditions must be true simultaneously. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) represents a high-severity, network-reachable, unauthenticated confidentiality compromise, scoring 8.7. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor-released patch per the CISA ICSMA-26-253-01 advisory at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01; exact fix versions should be obtained directly from that advisory, as no specific patched release number was included in the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Mirth Connect deployments in use and determine which instances have XPath batch XML processing enabled; assess network accessibility and data sensitivity of affected systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.