{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22314", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "state": "PUBLISHED", "assignerShortName": "ENISA", "dateReserved": "2026-01-07T09:31:00.563Z", "datePublished": "2026-05-20T10:29:38.661Z", "dateUpdated": "2026-10-01T19:31:41.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-10-01T19:31:41.782Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"vendor": "Mesalvo", "product": "Meona Client Launcher Component", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "19.06.2020 15:11:49", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Mesalvo", "product": "Meona Server Component", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2025.04 5+323020", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Vendor disputed record. The reported behaviour is documented \nadministrative functionality restricted to dedicated administrative \npermissions assigned by the operating hospital; its use by a permission \nholder is not a vulnerability. Unauthorised access to the functions is \naddressed under CVE-2026-0856.\n\nImproper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems.\u00a0This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<i>Vendor disputed record. The reported behaviour is documented \nadministrative functionality restricted to dedicated administrative \npermissions assigned by the operating hospital; its use by a permission \nholder is not a vulnerability. Unauthorised access to the functions is \naddressed under CVE-2026-0856.</i><br><br>Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems.&nbsp;This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020."}]}], "tags": ["disputed"], "references": [{"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-003.pdf", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.9, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-20T12:29:31.474390Z", "id": "CVE-2026-22314", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T12:34:04.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22314", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-20T12:29:31.474390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T12:30:06.197Z"}}], "cna": {"tags": ["disputed"], "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mesalvo", "product": "Meona Client Launcher Component", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "19.06.2020 15:11:49"}], "defaultStatus": "unaffected"}, {"vendor": "Mesalvo", "product": "Meona Server Component", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.04 5+323020"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-003.pdf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Vendor disputed record. The reported behaviour is documented \nadministrative functionality restricted to dedicated administrative \npermissions assigned by the operating hospital; its use by a permission \nholder is not a vulnerability. Unauthorised access to the functions is \naddressed under CVE-2026-0856.\n\nImproper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems.\u00a0This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.", "supportingMedia": [{"type": "text/html", "value": "<i>Vendor disputed record. The reported behaviour is documented \nadministrative functionality restricted to dedicated administrative \npermissions assigned by the operating hospital; its use by a permission \nholder is not a vulnerability. Unauthorised access to the functions is \naddressed under CVE-2026-0856.</i><br><br>Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems.&nbsp;This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-10-01T19:31:41.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22314", "state": "PUBLISHED", "dateUpdated": "2026-10-01T19:31:41.782Z", "dateReserved": "2026-01-07T09:31:00.563Z", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "datePublished": "2026-05-20T10:29:38.661Z", "assignerShortName": "ENISA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Meona Client Launcher Component", "vendor": "Mesalvo", "versions": [{"lessThanOrEqual": "19.06.2020 15:11:49", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Meona Server Component", "vendor": "Mesalvo", "versions": [{"lessThanOrEqual": "2025.04 5+323020", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "cveTags": [{"sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Vendor disputed record. The reported behaviour is documented \nadministrative functionality restricted to dedicated administrative \npermissions assigned by the operating hospital; its use by a permission \nholder is not a vulnerability. Unauthorised access to the functions is \naddressed under CVE-2026-0856.\n\nImproper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems.\u00a0This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020."}, {"lang": "es", "value": "Vulnerabilidad de control inadecuado de la generaci\u00f3n de c\u00f3digo ('Inyecci\u00f3n de c\u00f3digo') en el Componente Lanzador de Cliente Mesalvo Meona, Componente de Servidor Mesalvo Meona permite la ejecuci\u00f3n de c\u00f3digo en los sistemas de otros usuarios. Este problema afecta al Componente Lanzador de Cliente Meona: hasta el 19.06.2020 15:11:49; Componente de Servidor Meona: hasta el 2025.04 5+323020."}], "id": "CVE-2026-22314", "lastModified": "2026-10-01T20:17:24.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 6.0, "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22314", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-20T12:29:31.474390Z", "version": "2.0.3"}}]}, "published": "2026-05-20T11:16:26.057", "references": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://mesalvo.com/en/vdp/advisories/msa-2026-003.pdf"}], "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,19.06.2020 15:11:49]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Meona Client Launcher Component", "source": "cna", "vendor": "Mesalvo"}, "product": "meona_client_launcher_component", "vendor": "mesalvo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.04 5+323020]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Meona Server Component", "source": "cna", "vendor": "Mesalvo"}, "product": "meona_server_component", "vendor": "mesalvo"}], "created": "2026-05-20T12:30:16.072427+00:00", "title": "Improper Control of Code Generation in Mesalvo Meona Components Enables Remote Code Execution", "updated": "2026-10-02T00:00:15.301490+00:00", "vendors": ["mesalvo", "mesalvo$PRODUCT$meona_client_launcher_component", "mesalvo$PRODUCT$meona_server_component"]}