XSLT Transformer Vulnerability in Affected Product by Vendor
CVE-2026-78224

8.8HIGH

Key Information:

Vendor

Nextgen Healthcare

Status
Mirth Connect
Vendor
CVE Published:
11 September 2026

What is CVE-2026-78224?

The XSLT Transformer configuration allows for the creation of a TransformerFactory without essential security options, which can lead to vulnerabilities. This misconfiguration could allow attackers to exploit XML External Entity (XXE) injection, potentially resulting in unauthorized data access and exfiltration, alongside significant denial-of-service attacks, posing serious risks to the integrity and availability of affected systems.

Affected Version(s)

Mirth Connect 0 <= 4.7.1

Mirth Connect 4.7.2

References

https://www.cisa.gov/news-events/ics-medical-advisories/i...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA.
.