A critical remote code execution vulnerability in Gematik Authenticator for macOS poses a severe risk to user systems and requires an immediate update to version 4.16.0 or greater.

The application is susceptible to OS command injection (CWE-78) due to improper neutralization of special elements in files. This flaw allows an unauthenticated attacker to achieve remote code execution if a victim is induced to open a specially crafted malicious file.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the host machine, potentially leading to a full system compromise. With a CVSS score of 7.8, this high-severity flaw threatens the confidentiality, integrity, and availability of sensitive health data managed by the application. Organizations utilizing this software face significant risks regarding data breaches and potential regulatory non-compliance.

Immediate Action: Update the Gematik Authenticator application to version 4.16.0 or higher immediately to apply the vendor-provided patch.

Proactive Monitoring: Review system and application logs for unusual process executions or unauthorized command-line activity originating from the Authenticator process.

Compensating Controls: Since no workarounds exist, ensure users are educated on the risks of opening files from untrusted sources, and implement endpoint security solutions to detect and block suspicious file executions.

Public Exploit Available: No (exploit_available: false).

The presence of a remote code execution vulnerability in a security-critical application like an authenticator presents an unacceptable level of risk. IT administrators must prioritize the deployment of version 4.16.0 across all macOS endpoints. Given the lack of available workarounds, patching remains the only effective method to neutralize this threat.