{"id":"CVE-2026-118462","kind":"vulnerability","aliases":["CVE-2026-118462"],"related":[],"title":"CompuGroup Medical update components (cgm.liveupdates, cgm.files.delivery) run downloaded code without verifying it","description":"Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.","summary":"Some update components download code and execute it without properly checking its authenticity, relying on ignored hashes or forgeable checksums. Some update paths also allow archive path traversal or script execution, so an attacker who can serve or alter an update may run code on the machine.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Venere","fixed":[],"affected":"<= 8.33.2","ecosystem":"vendor"},{"name":"Phronesis","fixed":[],"affected":"<= 4.51.0.1","ecosystem":"vendor"},{"name":"Infantia","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"},{"name":"Profim","fixed":[],"affected":"<= 6.09.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["auto-update","cgm","compugroup-medical","healthcare","other","self-hosted","updater"],"not_affected_if":[],"how_to_check":"Compare installed versions with the ACN list: Venere <= 8.33.2, Phronesis <= 4.51.0.1, Infantia <= 6.09.1, Profim <= 6.09.1; also check the installed cgm.liveupdates (<= 2.12.0) and cgm.files.delivery (<= 1.3.0) components. Also check if you run XDent/XMedical 4.4.0 or Wingesfar before 2026.07a (same ACN bulletin, mapping to this CVE not confirmed).","fix":null,"status":"open","published_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:17+00:00","updated_at":"2026-11-09T12:29:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T12:27:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Update components run downloaded code without verifying authenticity or checksums","impact":"high","summary":"Some update components download code and execute it without properly checking its authenticity, relying on ignored hashes or forgeable checksums. Some update paths also allow archive path traversal or script execution, so an attacker who can serve or alter an update may run code on the machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["updater","auto-update"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs with update privileges on the machine","analyst_note":"Identify which product's update components are affected; the NVD entry names no product or fixed version; check the NVD page and vendor advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000629,"input_tokens":4499,"output_tokens":358,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify which product's update components are affected; the NVD entry names no product or fixed version; check the NVD page and vendor advisory.","search":"'-118462':14A,17A '-2026':13A,16A 'allow':59B 'also':58B,102C 'alter':73B 'archiv':60B,104C 'attack':68B 'authent':47B,90C 'auto':23B 'auto-upd':22B 'cgm':25B 'cgm.files.delivery':6A 'cgm.liveupdates':5A 'check':45B 'checksum':54B,98C 'code':9A,39B,78B,87C 'compon':4A,37B,83C 'compugroup':1A,27B 'compugroup-med':26B 'cve':12A,15A 'download':8A,38B,84C 'execut':41B,65B,86C,108C 'forgeabl':53B,97C 'hash':51B,95C 'healthcar':29B 'host':33B 'ignor':50B,94C 'infantia':20A 'machin':81B 'may':76B 'medic':2A,28B 'path':57B,61B,101C 'permit':103C 'phronesis':19A 'profim':21A 'proper':44B,89C 'reli':48B,92C 'run':7A,77B 'script':64B,107C 'self':32B 'self-host':31B 'serv':71B 'travers':62B,105C 'updat':3A,24B,34B,36B,56B,75B,82C,100C 'venere':18A 'verif':91C 'verifi':11A 'without':10A,43B,88C","nicknames":[],"mitigations":[],"who_affected":"NVD names CompuGroup Medical's Infantia, Profim, Venere and Phronesis, through their update packages cgm.files.delivery (through 1.3.0) and cgm.liveupdates (through 2.12.0). An attacker who can serve or tamper with an update (network position, compromised update server) could get code run on the machine. The Italian ACN bulletin lists other CGM products (XDent, XMedical, Wingesfar) for the same batch of CVEs, but this page does not say which CVE applies to them, so do not assume they are affected by this one. Anyone not running these CGM products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["infantia","phronesis","profim","venere"],"ptokens":["infantia","phronesis","profim","venere"],"labels":["autoupdate","cgm","compugroupmedical","critical","healthcare","other","selfhosted","updater"],"campaign_type":null,"search_a":"'-118462':14A,17A '-2026':13A,16A 'cgm.files.delivery':6A 'cgm.liveupdates':5A 'code':9A 'compon':4A 'compugroup':1A 'cve':12A,15A 'download':8A 'infantia':20A 'medic':2A 'phronesis':19A 'profim':21A 'run':7A 'updat':3A 'venere':18A 'verifi':11A 'without':10A","search_b":"'allow':59B 'also':58B 'alter':73B 'archiv':60B 'attack':68B 'authent':47B 'auto':23B 'auto-upd':22B 'cgm':25B 'check':45B 'checksum':54B 'code':39B,78B 'compon':37B 'compugroup':27B 'compugroup-med':26B 'download':38B 'execut':41B,65B 'forgeabl':53B 'hash':51B 'healthcar':29B 'host':33B 'ignor':50B 'machin':81B 'may':76B 'medic':28B 'path':57B,61B 'proper':44B 'reli':48B 'run':77B 'script':64B 'self':32B 'self-host':31B 'serv':71B 'travers':62B 'updat':24B,34B,36B,56B,75B 'without':43B","search_c":"'also':102C 'archiv':104C 'authent':90C 'checksum':98C 'code':87C 'compon':83C 'download':84C 'execut':86C,108C 'forgeabl':97C 'hash':95C 'ignor':94C 'path':101C 'permit':103C 'proper':89C 'reli':92C 'script':107C 'travers':105C 'updat':82C,100C 'verif':91C 'without':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118462","severity":null,"published_at":"2026-11-09T12:16:37+00:00","modified_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118462:2282","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T12:29:13+00:00","modified_at":"2026-11-09T12:29:13+00:00","first_seen_at":"2026-11-09T12:29:13+00:00","fetched_at":"2026-11-09T12:29:13+00:00","note":"NVD (via WebFetch of API) points to ACN bulletin on CompuGroup Medical; ACN lists affected versions, no fixed versions (except Wingesfar 2026.07a), advises updating via CGM support channels; no PoC/exploitation reported. Vendor CGM press release not read (web-cli out of credits). Per-CVE product mapping and cgm.* package ranges come from NVD summary only; nothing marked verified.","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://nvd.nist.gov/vuln/detail/CVE-2026-118462"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107408,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118462","title":"NVD CVE-2026-118462","kind":"other","source":"analyst","publisher":null,"text":"Update components download and execute code without authenticity checks (ignored hashes/forgeable checksums); some paths allow archive traversal or script execution. Lists Infantia, Profim, Venere, Phronesis (CompuGroup Medical); packages cgm.files.delivery through 1.3.0, cgm.liveupdates through 2.12.0. References: ACN bulletin and CGM press release.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}