CVE-2026-50773: CGM ISIS MED RCE Vulnerability

CVE-2026-50773 Overview

CVE-2026-50773 affects CompuGroup Medical CGM ISIS MED version 2510.1.0.20, a medical practice management application distributed by CGM Germany. The vulnerability allows a local attacker to execute arbitrary code by placing a crafted Dynamic-Link Library (DLL) file in a location where the application will load it. The flaw is classified as an Uncontrolled Search Path Element issue [CWE-427], commonly known as DLL hijacking or DLL search order hijacking. Successful exploitation requires user interaction and grants the attacker the privileges of the account running the vulnerable application.

Critical Impact
A local attacker can achieve arbitrary code execution on healthcare workstations running CGM ISIS MED by planting a malicious DLL, potentially exposing patient data and enabling lateral movement.

Affected Products

CompuGroup Medical CGM ISIS MED 2510.1.0.20
CGM Germany distributions of the affected build
Windows workstations running the vulnerable installation

Discovery Timeline

2026-08-17 - CVE-2026-50773 published to the National Vulnerability Database
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-50773

Vulnerability Analysis

CGM ISIS MED loads one or more DLLs using an uncontrolled search path. When the application resolves a DLL name without specifying a fully qualified path, Windows searches a defined list of directories, including the application's working directory. An attacker who can write a crafted DLL to a searched location causes the application to load attacker-controlled code into its process. Execution occurs in the security context of the user running CGM ISIS MED, which in clinical environments frequently includes access to patient records and network shares. The vulnerability requires local access and user interaction, typically the launch of the affected application.

Root Cause

The root cause is improper handling of the DLL search order [CWE-427]. The application does not pin sensitive library imports to trusted, absolute paths and does not enforce a safe search mode. As a result, DLLs placed in writable directories that appear early in the search order are loaded ahead of legitimate system libraries.

Attack Vector

Exploitation follows the standard DLL preloading pattern. The attacker identifies a DLL name the application attempts to load but does not fully qualify. The attacker writes a malicious DLL with that name to a directory the application searches, such as the working directory, a per-user application data folder, or a shared installer directory. When a user launches CGM ISIS MED, the malicious DLL loads and its DllMain entry point executes arbitrary code. See the GitHub CVE Repository for public technical details.

Detection Methods for CVE-2026-50773

Indicators of Compromise

Unsigned or unexpected DLL files present in the CGM ISIS MED installation directory or per-user application data paths.
DLL module loads originating from user-writable directories rather than C:\Windows\System32 or the signed application directory.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from the CGM ISIS MED process tree.

Detection Strategies

Monitor Sysmon Event ID 7 (Image Loaded) for the CGM ISIS MED executable loading DLLs from non-standard directories.
Alert on file writes of .dll files to directories that also contain CGM ISIS MED executables.
Baseline the expected set of DLLs loaded by the application and flag deviations, including unsigned modules.

Monitoring Recommendations

Enable and forward Sysmon ImageLoad and FileCreate events for medical workstation endpoints.
Track process lineage from the CGM ISIS MED executable and flag anomalous child processes.
Review Windows Defender Application Control or AppLocker logs for blocked or bypassed DLL loads.

How to Mitigate CVE-2026-50773

Immediate Actions Required

Restrict write permissions on all CGM ISIS MED installation directories and any per-user working directories used by the application.
Enforce application allow-listing (AppLocker or Windows Defender Application Control) to block execution of unsigned DLLs from user-writable paths.
Contact CompuGroup Medical support through the CGM company website to obtain a fixed build and patch guidance.

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry for CVE-2026-50773. Administrators should consult CompuGroup Medical directly for a remediated version that supersedes CGM ISIS MED 2510.1.0.20 and confirms mitigation of the Uncontrolled Search Path Element weakness.

Workarounds

Run CGM ISIS MED under least-privilege user accounts to limit the impact of arbitrary code execution.
Set SafeDllSearchMode and configure CWDIllegalInDllSearch via registry policy to remove the current working directory from the DLL search path.
Deploy endpoint protection that inspects DLL loads and blocks unsigned modules loaded from user-writable directories.

bash

# Configuration example: harden DLL search behavior on Windows endpoints
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f