CVE-2026-22314

Improper Control of Code Generation in Mesalvo Meona Components Enables Remote Code Execution

View on CVE.org
Published May 20, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority based on the reported functionality projecting intended administrative
functionality.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 7.9, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
Description Vendor disputed record. The reported behaviour is documented administrative functionality restricted to dedicated administrative permissions assigned by the operating hospital; its use by a permission holder is not a vulnerability. Unauthorised access to the functions is addressed under CVE-2026-0856. Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority based on the reported functionality projecting intended administrative functionality.
Type Values Removed Values Added
Title Improper Control of Code Generation in Mesalvo Meona Components Enables Remote Code Execution
Type Values Removed Values Added
Description Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. Vendor disputed record. The reported behaviour is documented administrative functionality restricted to dedicated administrative permissions assigned by the operating hospital; its use by a permission holder is not a vulnerability. Unauthorised access to the functions is addressed under CVE-2026-0856. Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.
Type Values Removed Values Added
Title Code Injection Vulnerability in Mesalvo Meona Components Allowing Remote Code Execution
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.9, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Mesalvo
Mesalvo meona Client Launcher Component
Mesalvo meona Server Component
Vendors & Products Mesalvo
Mesalvo meona Client Launcher Component
Mesalvo meona Server Component
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Code Injection Vulnerability in Mesalvo Meona Components Allowing Remote Code Execution
Type Values Removed Values Added
Description Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}
Earlier changes (8)
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
ENISA
Published
Updated
Oct 13, 2026, 1:56 PM
Reserved
Jan 7, 2026, 9:31 AM

View source JSON

Updated

JSON

Status
Rejected
Published
May 20, 2026, 11:16 AM
Modified
Oct 13, 2026, 2:17 PM

View source JSON

No data.

No data.