{"id":"CVE-2026-118790","kind":"vulnerability","aliases":["CVE-2026-118790"],"related":[],"title":"CompuGroup Medical Wingesfar: hardcoded credentials in components and admin functions","description":"Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.","summary":"Several product components and admin functions ship with built-in credentials that cannot be changed by the customer. An attacker who knows or finds these credentials can log in to privileged accounts, services, or features on affected deployments.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Wingesfar","fixed":["2026.07a"],"affected":"< 2026.07a","ecosystem":"vendor"}],"ecosystems":[],"tags":["compugroup-medical","enterprise-software","hardcoded-credentials","healthcare","other","pharmacy","wingesfar"],"not_affected_if":[],"how_to_check":"Check the installed Wingesfar version; anything before 2026.07a is in the affected range. Also check any CGM product (XDent, XMedical, Venere, Phronesis, Infantia, Profim) with your CGM support contact, since the ACN advisory does not map CVEs to products.","fix":"Wingesfar 2026.07a or later (per the CVE record's affected range; CGM says fixes are pushed automatically to affected installations).","status":"open","published_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:34+00:00","updated_at":"2026-11-09T13:28:25+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T13:27:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Hardcoded credentials in product components grant privileged unauthorized access","impact":"high","summary":"Several product components and admin functions ship with built-in credentials that cannot be changed by the customer. An attacker who knows or finds these credentials can log in to privileged accounts, services, or features on affected deployments.","audience":"businesses","category":"other","nicknames":[],"who_cares":["enterprise-software"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker logs into privileged accounts using built-in credentials.","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118790 and the vendor advisory it links to.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product, versions, or components, so exposure cannot be determined from them. Teams running software that exposes administrative functions should look for the vendor's advisory to identify the affected product.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4503,"output_tokens":427,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118790 and the vendor advisory it links to.","search":"'-118790':13A,16A '-2026':12A,15A 'access':86C 'account':63B,89C 'across':94C 'admin':9A,35B 'administr':79C 'affect':68B,95C 'applic':92C 'attack':51B 'built':40B 'built-in':39B 'cannot':44B 'chang':46B 'compon':7A,33B,77C 'compugroup':1A,19B 'compugroup-med':18B 'credenti':5A,26B,42B,57B,72C,82C 'custom':49B 'cve':11A,14A 'deploy':69B,96C 'embed':74C 'enabl':84C 'enterpris':22B 'enterprise-softwar':21B 'featur':66B,93C 'find':55B 'function':10A,36B,80C 'hardcod':4A,25B,71C 'hardcoded-credenti':24B 'healthcar':27B 'know':53B 'log':59B 'may':83C 'medic':2A,20B 'multipl':70C 'pharmaci':29B 'privileg':62B,88C 'product':32B,76C 'servic':64B,90C 'sever':31B 'ship':37B 'softwar':23B 'unauthor':85C 'wingesfar':3A,17A,30B 'within':75C","nicknames":[],"mitigations":[],"who_affected":"Pharmacies and practices running CompuGroup Medical Wingesfar before 2026.07a. Built-in credentials in components and admin functions could let a remote unauthenticated attacker reach privileged accounts or features under specific conditions. CGM's other listed products (XDent, XMedical, Venere, Phronesis, Infantia, Profim) are in the same ACN advisory but not confirmed for this CVE.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wingesfar"],"ptokens":["wingesfar"],"labels":["compugroupmedical","enterprisesoftware","hardcodedcredentials","healthcare","high","other","pharmacy","wingesfar"],"campaign_type":null,"search_a":"'-118790':13A,16A '-2026':12A,15A 'admin':9A 'compon':7A 'compugroup':1A 'credenti':5A 'cve':11A,14A 'function':10A 'hardcod':4A 'medic':2A 'wingesfar':3A,17A","search_b":"'account':63B 'admin':35B 'affect':68B 'attack':51B 'built':40B 'built-in':39B 'cannot':44B 'chang':46B 'compon':33B 'compugroup':19B 'compugroup-med':18B 'credenti':26B,42B,57B 'custom':49B 'deploy':69B 'enterpris':22B 'enterprise-softwar':21B 'featur':66B 'find':55B 'function':36B 'hardcod':25B 'hardcoded-credenti':24B 'healthcar':27B 'know':53B 'log':59B 'medic':20B 'pharmaci':29B 'privileg':62B 'product':32B 'servic':64B 'sever':31B 'ship':37B 'softwar':23B 'wingesfar':30B","search_c":"'access':86C 'account':89C 'across':94C 'administr':79C 'affect':95C 'applic':92C 'compon':77C 'credenti':72C,82C 'deploy':96C 'embed':74C 'enabl':84C 'featur':93C 'function':80C 'hardcod':71C 'may':83C 'multipl':70C 'privileg':88C 'product':76C 'servic':90C 'unauthor':85C 'within':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118790","severity":null,"published_at":"2026-11-09T13:17:05+00:00","modified_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118790:2292","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T13:28:25+00:00","modified_at":"2026-11-09T13:28:25+00:00","first_seen_at":"2026-11-09T13:28:25+00:00","fetched_at":"2026-11-09T13:28:25+00:00","note":"NVD record (via API) names CGM Wingesfar < 2026.07a; ACN advisory (v1.1, 6 Nov 2026) lists this CVE among 16 for CGM products without per-CVE mapping or fixed versions; CGM press release says no evidence of exploitation and fixes auto-distributed. No PoC or exploitation found. Exa search and X not available (credits); nothing marked verified because fixed version comes from the CVE record, not the vendor's own words.","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107410,"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","title":"CGM Italia risolve potenziali vulnerabilità software insieme a CSIRT Italia","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}