CVE-2026-22314: Mesalvo Meona code injection in Client Launcher and Server components

CVE-2026-22314 · Severity: critical · CVSS 9 · Published 2026-05-20

Mesalvo Meona is a healthcare management application used to manage patient data and clinical workflows. A vulnerability in the system allows an attacker with basic user access to inject malicious scripts or configurations that execute on other users' computers. This could lead to a total compromise of clinical workstations, unauthorized access to sensitive patient records, and lateral movement across the healthcare provider's network.

Technologies: Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component. Vendors: Mesalvo.

Quick answers

Is CVE-2026-22314 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22314 being exploited in the wild.
How severe is CVE-2026-22314?
Critical severity, with a CVSS score of 9, published 20 May 2026.
Which products and versions are affected?
Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49; Mesalvo Meona Server Component through 2025.04 5+323020.
Is there a fix for CVE-2026-22314?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22314 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-22314?
Check whether you run Mesalvo Meona Client Launcher Component or Mesalvo Meona Server Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in the Mesalvo Meona Client Launcher and Server components. The flaw stems from improper control of code generation within administrative features, where the application allows the addition of scripts in various programming languages or the modification of XML-based configurations. An attacker with low-privileged credentials can abuse these features to push malicious code that is subsequently executed on other client systems running Meona. This vulnerability was identified during a red team engagement and can be used for lateral movement within the target network. While the manufacturer has indicated plans to release patches in May/June 2026, users should monitor for unauthorized changes to script configurations within the Meona admin interface.

Affected products

  • Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49
  • Mesalvo Meona Server Component through 2025.04 5+323020

Timeline

  • 2026-01-08: other: Requested CVE identifiers and notified manufacturer
  • 2026-01-12: other: Received CVE identifiers
  • 2026-05-04: other: Manufacturer requested publication of the CVEs
  • 2026-05-13: disclosed: Initial blog post release by SecCore
  • 2026-05-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.