SPACECOM · CVE-2026-97358 · Other
NO FIX YET
B. Braun Melsungen (CNA, productsecurity@bbraun.com) reports that SpaceCom, the network communication module of the Space infusion pump system, includes web functionality from an untrusted source (CWE-94), which could allow remote code execution. VulDB lists the affected versions as up to U/L94 (secondary source). B. Braun's own bulletin for this CVE was not found, so the fix, trigger and exact version range are unconfirmed. No exploitation or public PoC is reported.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Hospitals and clinics that run B. Braun Space infusion systems with a SpaceCom communication module (VulDB lists versions up to U/L94). Per B. Braun's earlier Space advisories, the communication devices are separate from the pumps; this CVE's own bulletin was not found, so whether pumps are affected is unconfirmed. Teams that do not run SpaceCom can skip it.
Who cares b-braun, infusion-pump, medical-device, rce, spacecom
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.