CVE-2026-22314CRITICAL 7.9EPSS p18.4%

CVE-2026-22314CVE-2026-22314

Description

Vendor disputed record. The reported behaviour is documented administrative functionality restricted to dedicated administrative permissions assigned by the operating hospital; its use by a permission holder is not a vulnerability. Unauthorised access to the functions is addressed under CVE-2026-0856. Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.

Scoring

CVSS 3.17.9 (CRITICAL)
VectorCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS0.28% probability of exploitation · percentile 18.4% · 2026-10-05T12:00:23Z
Published2026-05-20
Last modified2026-10-01

Underlying weaknesses· 1

CWE-94

References

  1. https://seccore.at/blog/cves-meona/

1

TypeTargetConfidenceTier
WeaknessImproper Control of Generation of Code ('Code Injection')cwe-940%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-29902
CVE
CVE-2026-21537
CVE
CVE-2025-48169
CVE
CVE-2026-3120
CVE
CVE-2026-32573
CVE
CVE-2026-29014
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.