High severity7.5NVD Advisory· Published Sep 11, 2026· Updated Sep 18, 2026
CVE-2026-82578
CVE-2026-82578
Description
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2News mentions
3- 24 Vulnerabilities Disclosed Across Multiple Products: Authentication, Injection, and Credential Flaws ExposedVypr Intelligence · Sep 11, 2026
- NextGen Mirth Connect Flaws Expose Downstream System LoginsGovInfoSecurity · Sep 10, 2026
- NextGen Healthcare Mirth ConnectCISA Alerts