Is CVE-2025-30047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-30047 being exploited in the wild.

How severe is CVE-2025-30047?

Informational severity, published 23 October 2026.

Which products and versions are affected?

CGM CLININET all before 2026.MS3.

Is there a fix for CVE-2025-30047?

Yes: fixed in 2026.MS3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-30047 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2025-30047?

Check whether you run CGM CLININET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-30047: CGM CLININET unsafe Java deserialization remote code execution

CVE-2025-30047 · Severity: info · Published 2026-10-23

CGM CLININET is a hospital information system that manages patient records, clinical workflows, and administrative functions across healthcare facilities. An attacker on the same local network can exploit an unauthenticated HTTP API to send a malicious serialized Java object, leading to arbitrary code execution with root privileges on the server and complete compromise of patient data and hospital operations.

Technologies: CGM CLININET. Vendors: CGM.

Quick answers

Is CVE-2025-30047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-30047 being exploited in the wild.
How severe is CVE-2025-30047?: Informational severity, published 23 October 2026.
Which products and versions are affected?: CGM CLININET all before 2026.MS3.
Is there a fix for CVE-2025-30047?: Yes: fixed in 2026.MS3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30047 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2025-30047?: Check whether you run CGM CLININET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.MS3

Technical details

The vulnerability stems from unsafe deserialization of untrusted Java objects in an HTTP API used by the administrative module. An attacker in an adjacent network sends a crafted serialized object to the exposed API endpoint, which is deserialized without proper validation. Upon deserialization, the malicious object triggers arbitrary code execution with root-level privileges, allowing full server compromise.

Affected products

CGM CLININET all before 2026.MS3

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.