WINGESFAR · CVE-2026-118460 · Other
FIX → 2026.07a
CompuGroup Medical (CGM Italia) software embeds private signing keys protected by one password shared across installations. An attacker who extracts them can sign identity assertions for any healthcare professional identifier and obtain practitioner tokens. CSIRT Italia lists it among several CGM flaws; CGM reports no evidence of exploitation.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Pharmacies, medical and dental practices in Italy running CGM software: XDent 4.4.0, XMedical 4.4.0, Wingesfar before 2026.07a, Venere up to 8.33.2, Phronesis up to 4.51.0.1, Infantia and Profim up to 6.09.1 (per the CSIRT Italia advisory, which does not map versions to individual CVEs). Others can skip it.
Who cares compugroup-medical, hardcoded-key, healthcare, italy, practitioner-auth, token-signing
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.07a