---
id: "CVE-2026-118460"
page: "https://infrastack.ai/live/CVE-2026-118460"
kind: "vulnerability"
aliases: ["CVE-2026-118460"]
title: "CompuGroup Medical Italy pharmacy and practice software ships private keys with a shared password, letting attackers forge practitioner assertions"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Wingesfar", "fixed": ["2026.07a"], "affected": "< 2026.07a", "ecosystem": "vendor"}, {"name": "Venere", "fixed": [], "affected": "<= 8.33.2", "ecosystem": "vendor"}, {"name": "Phronesis", "fixed": [], "affected": "<= 4.51.0.1", "ecosystem": "vendor"}, {"name": "Infantia", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}, {"name": "Profim", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}, {"name": "XDent", "fixed": [], "affected": "4.4.0", "ecosystem": "vendor"}, {"name": "XMedical", "fixed": [], "affected": "4.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["compugroup-medical", "hardcoded-key", "healthcare", "italy", "other", "practitioner-auth", "token-signing"]
not_affected_if: []
published_at: "2026-11-09T12:16:36+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118460", "first_seen_at": "2026-11-09T12:26:23+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T12:31:01+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}]
exploit_sources: []
---

# CompuGroup Medical Italy pharmacy and practice software ships private keys with a shared password, letting attackers forge practitioner assertions

Link for people: https://infrastack.ai/live/CVE-2026-118460 (this .md is for agents)

CompuGroup Medical (CGM Italia) software embeds private signing keys protected by one password shared across installations. An attacker who extracts them can sign identity assertions for any healthcare professional identifier and obtain practitioner tokens. CSIRT Italia lists it among several CGM flaws; CGM reports no evidence of exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Wingesfar affected < 2026.07a fixed 2026.07a
- vendor:Venere affected <= 8.33.2 fixed no fixed version listed
- vendor:Phronesis affected <= 4.51.0.1 fixed no fixed version listed
- vendor:Infantia affected <= 6.09.1 fixed no fixed version listed
- vendor:Profim affected <= 6.09.1 fixed no fixed version listed
- vendor:XDent affected 4.4.0 fixed no fixed version listed
- vendor:XMedical affected 4.4.0 fixed no fixed version listed

## How to check

Check the installed version of the CGM product (XDent, XMedical, Wingesfar, Venere, Phronesis, Infantia, Profim) against the list in the CSIRT Italia advisory; Wingesfar is affected before 2026.07a. Confirm with CGM support that the update was applied.

## Fix

CGM says fixes are distributed automatically to affected installations; CSIRT Italia recommends updating through CGM's support channels. No fixed version numbers are published except Wingesfar 2026.07a.

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118460
- 2026-11-09T12:31:01+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — NVD lists CompuGroup Medical (CGM Italia) products; CSIRT Italia advisory lists XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1 (not mapped per-CVE). No fixed versions published; CGM says fixes are pushed automatically and no exploitation evidence. web-cli out of credits, so no social search.

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [fix] CGM Italia: fixes distributed automatically, with CSIRT Italia https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html

## From the sources

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_