{"id":"CVE-2026-118460","kind":"vulnerability","aliases":["CVE-2026-118460"],"related":[],"title":"CompuGroup Medical Italy pharmacy and practice software ships private keys with a shared password, letting attackers forge practitioner assertions","description":"Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.","summary":"CompuGroup Medical (CGM Italia) software embeds private signing keys protected by one password shared across installations. An attacker who extracts them can sign identity assertions for any healthcare professional identifier and obtain practitioner tokens. CSIRT Italia lists it among several CGM flaws; CGM reports no evidence of exploitation.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Wingesfar","fixed":["2026.07a"],"affected":"< 2026.07a","ecosystem":"vendor"},{"name":"Venere","fixed":[],"affected":"<= 8.33.2","ecosystem":"vendor"},{"name":"Phronesis","fixed":[],"affected":"<= 4.51.0.1","ecosystem":"vendor"},{"name":"Infantia","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"},{"name":"Profim","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"},{"name":"XDent","fixed":[],"affected":"4.4.0","ecosystem":"vendor"},{"name":"XMedical","fixed":[],"affected":"4.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["compugroup-medical","hardcoded-key","healthcare","italy","other","practitioner-auth","token-signing"],"not_affected_if":[],"how_to_check":"Check the installed version of the CGM product (XDent, XMedical, Wingesfar, Venere, Phronesis, Infantia, Profim) against the list in the CSIRT Italia advisory; Wingesfar is affected before 2026.07a. Confirm with CGM support that the update was applied.","fix":"CGM says fixes are distributed automatically to affected installations; CSIRT Italia recommends updating through CGM's support channels. No fixed version numbers are published except Wingesfar 2026.07a.","status":"open","published_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:20+00:00","updated_at":"2026-11-09T12:31:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T12:27:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Embedded shared-password private keys let attackers forge practitioner identity assertions","impact":"high","summary":"The product ships private signing keys that are protected by a single shared password embedded in the software. An attacker who extracts them can sign assertions for any practitioner identifier and obtain unauthorized practitioner tokens.","audience":"businesses","category":"other","nicknames":[],"who_cares":["healthcare","practitioner-auth","token-signing"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker forges practitioner tokens for any practitioner identifier","analyst_note":"Identify the affected product and vendor from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-118460), then find its advisory for fixed versions and remediation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4507,"output_tokens":403,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-118460), then find its advisory for fixed versions and remediation.","search":"'-118460':22A,25A '-2026':21A,24A 'across':62B 'among':86B 'arbitrari':112C 'assert':19A,72B,110C 'attack':16A,65B 'auth':44B 'cgm':50B,88B,90B 'compugroup':1A,34B,48B 'compugroup-med':33B 'csirt':82B 'cve':20A,23A 'emb':53B 'embed':96C 'enabl':115C 'evid':93B 'exploit':95B 'extract':67B 'flaw':89B 'forg':17A 'hardcod':37B 'hardcoded-key':36B 'healthcar':39B,75B 'ident':71B 'identifi':77B,114C 'infantia':29A 'instal':63B 'itali':3A,40B 'italia':51B,83B 'key':10A,38B,56B,98C 'let':15A 'list':84B 'medic':2A,35B,49B 'obtain':79B 'one':59B 'password':14A,60B,103C 'pharmaci':4A 'phronesis':28A 'practic':6A 'practition':18A,43B,80B,109C,113C,117C 'practitioner-auth':42B 'privat':9A,54B,97C 'profession':76B 'profim':30A 'protect':57B,99C 'report':91B 'request':119C 'sever':87B 'share':13A,61B,102C 'ship':8A 'sign':47B,55B,70B,108C 'softwar':7A,52B 'token':46B,81B,118C 'token-sign':45B 'unauthor':116C 'use':106C 'venere':27A 'wingesfar':26A 'xdent':31A 'xmedical':32A","nicknames":[],"mitigations":[],"who_affected":"Pharmacies, medical and dental practices in Italy running CGM software: XDent 4.4.0, XMedical 4.4.0, Wingesfar before 2026.07a, Venere up to 8.33.2, Phronesis up to 4.51.0.1, Infantia and Profim up to 6.09.1 (per the CSIRT Italia advisory, which does not map versions to individual CVEs). Others can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["infantia","phronesis","profim","venere","wingesfar","xdent","xmedical"],"ptokens":["infantia","phronesis","profim","venere","wingesfar","xdent","xmedical"],"labels":["compugroupmedical","hardcodedkey","healthcare","high","italy","other","practitionerauth","tokensigning"],"campaign_type":null,"search_a":"'-118460':22A,25A '-2026':21A,24A 'assert':19A 'attack':16A 'compugroup':1A 'cve':20A,23A 'forg':17A 'infantia':29A 'itali':3A 'key':10A 'let':15A 'medic':2A 'password':14A 'pharmaci':4A 'phronesis':28A 'practic':6A 'practition':18A 'privat':9A 'profim':30A 'share':13A 'ship':8A 'softwar':7A 'venere':27A 'wingesfar':26A 'xdent':31A 'xmedical':32A","search_b":"'across':62B 'among':86B 'assert':72B 'attack':65B 'auth':44B 'cgm':50B,88B,90B 'compugroup':34B,48B 'compugroup-med':33B 'csirt':82B 'emb':53B 'evid':93B 'exploit':95B 'extract':67B 'flaw':89B 'hardcod':37B 'hardcoded-key':36B 'healthcar':39B,75B 'ident':71B 'identifi':77B 'instal':63B 'itali':40B 'italia':51B,83B 'key':38B,56B 'list':84B 'medic':35B,49B 'obtain':79B 'one':59B 'password':60B 'practition':43B,80B 'practitioner-auth':42B 'privat':54B 'profession':76B 'protect':57B 'report':91B 'sever':87B 'share':61B 'sign':47B,55B,70B 'softwar':52B 'token':46B,81B 'token-sign':45B","search_c":"'arbitrari':112C 'assert':110C 'embed':96C 'enabl':115C 'identifi':114C 'key':98C 'password':103C 'practition':109C,113C,117C 'privat':97C 'protect':99C 'request':119C 'share':102C 'sign':108C 'token':118C 'unauthor':116C 'use':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118460","severity":null,"published_at":"2026-11-09T12:16:36+00:00","modified_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118460:2286","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T12:31:01+00:00","modified_at":"2026-11-09T12:31:01+00:00","first_seen_at":"2026-11-09T12:31:01+00:00","fetched_at":"2026-11-09T12:31:01+00:00","note":"NVD lists CompuGroup Medical (CGM Italia) products; CSIRT Italia advisory lists XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1 (not mapped per-CVE). No fixed versions published; CGM says fixes are pushed automatically and no exploitation evidence. web-cli out of credits, so no social search.","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107410,"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","title":"CGM Italia: fixes distributed automatically, with CSIRT Italia","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}