Vulnerability · Published Oct 23, 2026 · Assigned by CERT-PL

CVE-2025-30047Remote Code Execution via Java Deserialization in CGM CLININET

Critical 9.4

In plain English

A critical-severity unsafe deserialization in CGM CLININET from CGM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.4%top 68.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3

Affected products (as reported)

Vendor	Product	Versions
CGM	CGM CLININET	0 – before 2026.MS3

Weakness: CWE-502 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://cert.pl/en/posts/2026/10/CVE-2025-30043/ third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html product