Is CVE-2026-22315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22315 being exploited in the wild.

How severe is CVE-2026-22315?

High severity, with a CVSS score of 7.2, published 20 May 2026.

Which products and versions are affected?

Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49; Mesalvo Meona Server Component through 2025.04 5+323020.

Is there a fix for CVE-2026-22315?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-22315 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-22315?

Check whether you run Mesalvo Meona Client Launcher Component or Mesalvo Meona Server Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22315: Mesalvo Meona incorrect privilege assignment in SQL interface

CVE-2026-22315 · Severity: high · CVSS 7.2 · Published 2026-05-20

Mesalvo Meona, a healthcare application used for patient management, contains a vulnerability in its administrative SQL interface. An authorized user with high-level privileges can exploit this interface to export sensitive user data, including cleartext passwords, and potentially perform NTLM relay attacks. This could lead to a total compromise of user accounts and lateral movement within the organization's network.

Technologies: Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component. Vendors: Mesalvo.

Quick answers

Is CVE-2026-22315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22315 being exploited in the wild.
How severe is CVE-2026-22315?: High severity, with a CVSS score of 7.2, published 20 May 2026.
Which products and versions are affected?: Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49; Mesalvo Meona Server Component through 2025.04 5+323020.
Is there a fix for CVE-2026-22315?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22315 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-22315?: Check whether you run Mesalvo Meona Client Launcher Component or Mesalvo Meona Server Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect privilege assignment vulnerability (CWE-266) exists in the Mesalvo Meona Client Launcher and Server components. The application provides an accessible SQL interface that fails to properly restrict sensitive data access or dangerous stored procedures. A remote attacker with high-level administrative privileges can utilize this interface to bypass logging mechanisms and extract cleartext passwords for all users. Additionally, the interface can be abused to initiate NTLM relay attacks via active SQL stored procedures. The vulnerability was identified during a red team engagement and affects Meona Server versions through 2025.04 5+323020.

Affected products

Mesalvo Meona Client Launcher Component through 19.06.2020 15:11:49
Mesalvo Meona Server Component through 2025.04 5+323020

Timeline

2026-01-08: other: Requested CVE identifiers and notified manufacturer
2026-01-12: other: Received CVE identifiers
2026-05-13: disclosed: Initial blog post release by SecCore
2026-05-20: advisory: NVD publication date

References

https://seccore.at/blog/cves-meona/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.