CGM has 11 CVEs on record. Disclosure cadence is accelerating: 11 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 11. The median CVSS is 8.6 (high), with 4 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 11 prev 0
Worst active — by depth score
CVE-2025-30050Critical· 9.4Remote Code Execution in CGM CLININET52CVE-2025-30047Critical· 9.4Remote Code Execution via Java Deserialization in CGM CLININET52CVE-2025-30054Critical· 9.3Local Privilege Escalation in CGM CLININET51CVE-2025-30046Critical· 9.0Remote Code Execution in CGM CLININET50CVE-2025-30052High· 8.8Authentication Bypass via IP Spoofing in CGM CLININET rsyncd48
CGM vulnerabilities
CVEs affecting CGM, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2025-30049High· 8.2Use of Unsalted MD5 Password Hashes in CGM CLININET
The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3
CVE-2025-30046Critical· 9.0Remote Code Execution in CGM CLININET
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent net…
CVE-2025-30045High· 8.6Code Injection in CGM CLININET
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged at…
CVE-2025-30043High· 7.1Missing Authentication in CGM CLININET
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of…
CVE-2025-30052High· 8.8Authentication Bypass via IP Spoofing in CGM CLININET rsyncd
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and g…
CVE-2025-30050Critical· 9.4Remote Code Execution in CGM CLININET
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network ca…
CVE-2025-30047Critical· 9.4Remote Code Execution via Java Deserialization in CGM CLININET
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker wi…
CVE-2025-58403Medium· 5.1Reflected Cross-Site Scripting (XSS) in CGM CLININET
CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in…
CVE-2025-30053Medium· 6.9Missing Authentication in CGM CLININET
The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
CVE-2025-30051Medium· 6.8Insecure File Permissions in CGM CLININET
The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This i…
CVE-2025-30054Critical· 9.3Local Privilege Escalation in CGM CLININET
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache …