The vulnerability arises because the XSLT Transformer Step in Mirth Connect builds a bare TransformerFactory without setting necessary security options to prevent XXE attacks. This allows an attacker to craft malicious XML inputs that exploit the XML External Entity processing, potentially causing unauthorized data disclosure or service disruption. The CVSS v3.1 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity impact.

Successful exploitation can result in data exfiltration due to XXE injection and denial-of-service attacks against the affected Mirth Connect service. The confidentiality of sensitive data may be compromised, while integrity remains unaffected. Availability impact is low but present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor NextGen Healthcare advisories for updates and consider applying any recommended temporary mitigations once available.