The CGM CLININET application stores user passwords as unsalted MD5 hashes, a weakness that allows attackers to recover passwords by performing offline brute‑force or dictionary attacks. If an attacker obtains a database backup or can intercept a hash, the lack of salting and the use of a weak hash function make it feasible to find the original passwords quickly, potentially compromising user accounts and any services reliant on those credentials. The primary impact is loss of confidentiality and potential elevation of privilege if administrative passwords are retrieved.

CGM CLININET, a medical network management solution provided by CGM. Earlier releases before the 2026.MS1 update are affected; the vulnerability was addressed in the 2026.MS1 and 2026.MS3 releases.

The CVSS score of 8.2 indicates a high severity flaw. No EPSS score is available, so the current exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog, which suggests it has not been widely exploited publicly. Attackers would need to obtain the stored MD5 hashes, after which offline brute‑force becomes practical due to the unsalted, fast MD5 algorithm. The attack vector is therefore likely local or remote, depending on the method used to acquire the hashes, but no direct remote code execution exists.