# CVE-2026-50773: CompuGroup Medical CGM ISIS MED DLL hijacking arbitrary code execution

Source: https://junglewise.ai/threats/cve-2026-50773-compugroup-medical-cgm-isis-med-dll-hijacking-arbitrary-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-50773 · Severity: high · CVSS 7.8 · Published 2026-08-17

CGM ISIS MED is a medical practice management software used by healthcare facilities to manage patient records and clinical operations. The software loads DLL libraries from a folder where low-privileged users have write access, allowing attackers to place malicious DLLs that execute with the application's privileges. An attacker can exploit this to execute arbitrary code and gain elevated privileges on affected systems.

Vendors: [CompuGroup Medical](https://junglewise.ai/threats/vendors/compugroup-medical).

## Quick answers

**Is CVE-2026-50773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50773 being exploited in the wild.

**How severe is CVE-2026-50773?** High severity, with a CVSS score of 7.8, published 17 August 2026.

**Which products and versions are affected?** CompuGroup Medical CGM ISIS MED 2510.1.0.20.

**Is there a fix for CVE-2026-50773?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50773 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-50773?** Check whether you run CompuGroup Medical CGM ISIS MED at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a DLL hijacking issue in CGM ISIS MED version 2510.1.0.20. The affected component is the SILoader.exe application, which attempts to load DLL files from the AppData\Local\Apps directory. Due to improper permission controls, the target directory allows write access to local users. An attacker with local access can place a malicious DLL (e.g., dfshim.dll) in the search path, causing the application to load and execute the attacker-supplied code with the same privileges as the application. No authentication or network access is required; only local file write access is needed. The impact is arbitrary code execution and potential privilege escalation. A patch or updated version has not yet been identified in the available advisory material.

## Affected products

- CompuGroup Medical CGM ISIS MED 2510.1.0.20

## Timeline

- 2026-08-17: disclosed

## References

- [https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50773](https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50773)
- [https://www.cgm.com/deu_de](https://www.cgm.com/deu_de)