CVE-2026-25602 Mesalvo CVE debrief

Who should care

Defenders of hospital networks and systems using MEONA Client and MEONA Server should assess exposure and verify if administrative roles are properly assigned and restricted. This includes reviewing the current role assignments and ensuring that only authorized personnel have access to the MEONA administration area.

Why it matters

CVE-2026-25602 allows users with specific administrative roles to send messages with content of their choosing from the server's address to a recipient of their choice, potentially leading to social engineering attacks. Defenders of hospital networks and systems using MEONA Client and MEONA Server should assess exposure and verify if administrative roles are properly assigned and restricted.

• Social engineering attacks may be possible through crafted messages
• Verification of administrative role assignments and restrictions is necessary
• Mail relay restrictions can limit the impact of the vulnerability

Technical summary

The vulnerability is caused by insufficient verification of data authenticity in the feedback function of MEONA Client and MEONA Server. Users with administrative roles can modify the client request to send a message with content of their choosing from the server's address to a recipient of their choice. This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24), and 2026.03 (before 2026.03.02). The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed.

Defensive priority

Assess exposure of MEONA Client and MEONA Server in your environment, especially if administrative roles are assigned to users who can access the internal network.

Recommended defensive actions

• Assess exposure of MEONA Client and MEONA Server in your environment
• Verify if administrative roles are properly assigned and restricted
• Restrict mail relay to limit recipients of MEONA sender address
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24), and 2026.03 (before 2026.03.02). The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital's administrators. Such a user who modifies the client request can cause the MEONA Server to send a with

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.