Is CVE-2025-58403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-58403 being exploited in the wild.

How severe is CVE-2025-58403?

Informational severity, published 23 October 2026.

Is there a fix for CVE-2025-58403?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-58403 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-58403?

Check whether you run CGM CLININET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-58403: CGM CLININET reflected cross-site scripting (XSS)

CVE-2025-58403 · Severity: info · Published 2026-10-23

CGM CLININET is a hospital information system used to manage patient records, medical documentation, and clinical workflows across healthcare facilities. A reflected cross-site scripting (XSS) vulnerability allows an unauthenticated attacker to inject malicious code into URLs that, when clicked by a user, executes in the victim's browser. An attacker can exploit this to steal session cookies, impersonate hospital staff, modify patient records, or access sensitive medical data.

Technologies: CGM CLININET. Vendors: CGM.

Quick answers

Is CVE-2025-58403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-58403 being exploited in the wild.
How severe is CVE-2025-58403?: Informational severity, published 23 October 2026.
Which products and versions are affected?: CGM CLININET up to 2026.MS3.
Is there a fix for CVE-2025-58403?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-58403 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-58403?: Check whether you run CGM CLININET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This reflected XSS vulnerability stems from improper neutralization of user-supplied input in the application's web interface. An attacker crafts a malicious URL containing JavaScript or HTML payloads which the application reflects back without sanitization, allowing client-side code execution. No authentication is required; the attack succeeds when a victim visits the crafted link, enabling session hijacking and privilege abuse within the hospital system.

Affected products

CGM CLININET up to 2026.MS3

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.