CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP‑based API, used by the administrative module, that exchanges data using Java object serialization. When an attacker within the same local network transmits a crafted serialized object to this API, the server deserializes it and allows arbitrary code execution with root privileges. The weakness is a classic deserialization flaw–CWE‑502. The impact is total compromise of the server, including data theft, manipulation, or further lateral movement.

All installations of CGM CLININET prior to the release of version 2026.MS3 are affected. The vulnerability affects the administrative HTTP API which is typically available on the server by default. No other versions or products were identified as impacted.

The CVSS score of 9.4 indicates a critical severity. The EPSS score is not available, but the lack of KEV listing suggests no publicly known exploits yet. However, the attack vector is local network based, meaning any entity that can reach the server’s admin API can craft and send a malicious payload. The exploit requires no special privileges beyond network access, and once executed it runs with root privileges on the host. Given the high severity and ease of exploitation, the threat is immediate and significant.