WINGESFAR · CVE-2026-118790 · Other
FIX → 2026.07a
Several product components and admin functions ship with built-in credentials that cannot be changed by the customer. An attacker who knows or finds these credentials can log in to privileged accounts, services, or features on affected deployments.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Pharmacies and practices running CompuGroup Medical Wingesfar before 2026.07a. Built-in credentials in components and admin functions could let a remote unauthenticated attacker reach privileged accounts or features under specific conditions. CGM's other listed products (XDent, XMedical, Venere, Phronesis, Infantia, Profim) are in the same ACN advisory but not confirmed for this CVE.
Who cares compugroup-medical, enterprise-software, hardcoded-credentials, healthcare, pharmacy, wingesfar
Upgrade to 2026.07a
Wingesfar 2026.07a or later (per the CVE record's affected range; CGM says fixes are pushed automatically to affected installations).
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.