VENERE · CVE-2026-118458 · Other
FIX → 2026.07a
CompuGroup Medical's Italian healthcare software (AIS common login module) ships a test data access object with plaintext password comparison for application codes H and V in production, so fixed administrator accounts can log in without valid credentials. CSIRT Italia lists it as hard-coded credentials, CVSS 4.0 8.1. No exploitation or PoC is recorded as of 6 Nov 2026.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Practices, dental clinics and pharmacies in Italy running CGM products listed by CSIRT Italia: XDent 4.4.0, XMedical 4.4.0, Wingesfar before 2026.07a, Venere 8.33.2 and earlier, Phronesis 4.51.0.1 and earlier, Infantia 6.09.1 and earlier, Profim 6.09.1 and earlier. The advisory does not map versions to individual CVEs, so these apply to the advisory as a whole. NVD separately lists the cgm.it.ais.common package up to 5.1.15.1.1 for Venere and Phronesis. Others can skip it.
Who cares ais, compugroup-medical, hard-coded-credentials, healthcare, italy, java
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.07a