CVE-2026-22314
Mesalvo Meona’s Client Launcher and Server components allow attackers to inject and run arbitrary code on other users’ machines. The flaw is exploitable over the network and requires only low effort and minimal privileges. It can compromise confidentiality, integrity, and availability of affected systems.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Mesalvo Meona Client Launcher Component (up to version 19.06.2020 15:11:49) and Mesalvo Meona Server Component (up to version 2025.04 5+323020).
Real-world impact
An attacker who exploits this vulnerability can run malicious code on the victim’s computer, potentially stealing data, modifying files, or taking full control of the system.
Why this severity
The CVSS score of 9 reflects that the vulnerability is network‑accessible (AV:N), requires low attack complexity (AC:L) and low privileges (PR:L), but still needs some user interaction (UI:R). The change in scope (S:C) and the high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) drive the critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 20, 2026 · May 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.