---
id: "CVE-2026-118458"
page: "https://infrastack.ai/live/CVE-2026-118458"
kind: "vulnerability"
aliases: ["CVE-2026-118458"]
title: "CompuGroup Medical (CGM Italia) software ships hard-coded administrator logins via a test authentication path"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Venere", "fixed": [], "affected": "<= 8.33.2", "ecosystem": "vendor"}, {"name": "Phronesis", "fixed": [], "affected": "<= 4.51.0.1", "ecosystem": "vendor"}, {"name": "Wingesfar", "fixed": ["2026.07a"], "affected": "< 2026.07a", "ecosystem": "vendor"}, {"name": "XDent", "fixed": [], "affected": "4.4.0", "ecosystem": "vendor"}, {"name": "XMedical", "fixed": [], "affected": "4.4.0", "ecosystem": "vendor"}, {"name": "Infantia", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}, {"name": "Profim", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ais", "compugroup-medical", "hard-coded-credentials", "healthcare", "italy", "java", "other"]
not_affected_if: []
published_at: "2026-11-09T12:16:36+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118458", "first_seen_at": "2026-11-09T12:26:23+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T12:31:01+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}]
exploit_sources: []
---

# CompuGroup Medical (CGM Italia) software ships hard-coded administrator logins via a test authentication path

Link for people: https://infrastack.ai/live/CVE-2026-118458 (this .md is for agents)

CompuGroup Medical's Italian healthcare software (AIS common login module) ships a test data access object with plaintext password comparison for application codes H and V in production, so fixed administrator accounts can log in without valid credentials. CSIRT Italia lists it as hard-coded credentials, CVSS 4.0 8.1. No exploitation or PoC is recorded as of 6 Nov 2026.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Venere affected <= 8.33.2 fixed no fixed version listed
- vendor:Phronesis affected <= 4.51.0.1 fixed no fixed version listed
- vendor:Wingesfar affected < 2026.07a fixed 2026.07a
- vendor:XDent affected 4.4.0 fixed no fixed version listed
- vendor:XMedical affected 4.4.0 fixed no fixed version listed
- vendor:Infantia affected <= 6.09.1 fixed no fixed version listed
- vendor:Profim affected <= 6.09.1 fixed no fixed version listed

## How to check

Find out which CGM product and version you run (XDent, XMedical, Wingesfar, Venere, Phronesis, Infantia, Profim) and compare with the list in the CSIRT Italia advisory. Fixed versions are not published, so ask CGM support whether the correction has been applied to your installation. Also check that the system is not reachable from the internet.

## Fix

CGM says corrections were released with CSIRT Italia and are distributed automatically to affected installations. No fixed version number is published, except that Wingesfar 2026.07a is implied as the first unaffected release. Confirm with CGM customer service.

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118458
- 2026-11-09T12:31:01+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — Primary: CGM press release (patched, auto-distributed, no exploitation found) and CSIRT Italia advisory (products/versions, not per CVE; NVD version scheme differs). web-cli/Exa had no credits; used WebFetch. NVD page needed API JSON. X not checked. Nothing marked verified: CGM page names no versions or CVE.

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [fix] CGM Italia: fixes distributed automatically, with CSIRT Italia https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html

## From the sources

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_