{"id":"CVE-2026-118464","kind":"vulnerability","aliases":["CVE-2026-118464"],"related":[],"title":"Shared crypto services use fixed vendor-wide secrets and reversible transforms","description":"Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.","summary":"Shared cryptographic services use fixed secrets common to a whole vendor, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields. An attacker who obtains one copy of the shared secret or the code can decrypt or reverse protected values across deployments.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clinical-software","healthcare","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:24+00:00","updated_at":"2026-11-09T12:27:24+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T12:27:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Shared crypto services use fixed vendor-wide secrets and reversible transforms","impact":"high","summary":"Shared cryptographic services use fixed secrets common to a whole vendor, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields. An attacker who obtains one copy of the shared secret or the code can decrypt or reverse protected values across deployments.","audience":"businesses","category":"other","nicknames":[],"who_cares":["healthcare","clinical-software"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Stored credentials and clinical fields can be decrypted or reversed","analyst_note":"Identify the affected vendor product and versions from NVD and vendor advisories; the sources given name no product or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4522,"output_tokens":395,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118464':15A,18A '-2026':14A,17A 'across':70B 'attack':52B 'clinic':20B,49B,96C 'clinical-softwar':19B 'code':63B 'common':29B 'configur':46B,93C 'copi':56B 'credenti':43B,90C 'crypto':2A 'cryptograph':24B,73C 'cve':13A,16A 'data':45B,92C 'decrypt':65B 'deploy':71B 'determinist':34B,81C 'field':50B,97C 'fix':5A,27B,76C 'healthcar':22B 'ipc':44B,91C 'iv':35B,82C 'null':36B,83C 'obtain':54B 'one':55B 'protect':42B,68B,89C 'revers':11A,39B,67B,86C 'salt':37B,84C 'secret':9A,28B,60B,80C 'servic':3A,25B,74C 'share':1A,23B,59B,72C 'softwar':21B 'transform':12A,40B,87C 'use':4A,26B,75C 'valu':47B,69B,94C 'vendor':7A,33B,78C 'vendor-wid':6A,77C 'whole':32B 'wide':8A,79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clinicalsoftware","healthcare","medium","other"],"campaign_type":null,"search_a":"'-118464':15A,18A '-2026':14A,17A 'crypto':2A 'cve':13A,16A 'fix':5A 'revers':11A 'secret':9A 'servic':3A 'share':1A 'transform':12A 'use':4A 'vendor':7A 'vendor-wid':6A 'wide':8A","search_b":"'across':70B 'attack':52B 'clinic':20B,49B 'clinical-softwar':19B 'code':63B 'common':29B 'configur':46B 'copi':56B 'credenti':43B 'cryptograph':24B 'data':45B 'decrypt':65B 'deploy':71B 'determinist':34B 'field':50B 'fix':27B 'healthcar':22B 'ipc':44B 'iv':35B 'null':36B 'obtain':54B 'one':55B 'protect':42B,68B 'revers':39B,67B 'salt':37B 'secret':28B,60B 'servic':25B 'share':23B,59B 'softwar':21B 'transform':40B 'use':26B 'valu':47B,69B 'vendor':33B 'whole':32B","search_c":"'clinic':96C 'configur':93C 'credenti':90C 'cryptograph':73C 'data':92C 'determinist':81C 'field':97C 'fix':76C 'ipc':91C 'iv':82C 'null':83C 'protect':89C 'revers':86C 'salt':84C 'secret':80C 'servic':74C 'share':72C 'transform':87C 'use':75C 'valu':94C 'vendor':78C 'vendor-wid':77C 'wide':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118464","severity":null,"published_at":"2026-11-09T12:16:37+00:00","modified_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}