---
id: "CVE-2026-118790"
page: "https://infrastack.ai/live/CVE-2026-118790"
kind: "vulnerability"
aliases: ["CVE-2026-118790"]
title: "CompuGroup Medical Wingesfar: hardcoded credentials in components and admin functions"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Wingesfar", "fixed": ["2026.07a"], "affected": "< 2026.07a", "ecosystem": "vendor"}]
ecosystems: []
tags: ["compugroup-medical", "enterprise-software", "hardcoded-credentials", "healthcare", "other", "pharmacy", "wingesfar"]
not_affected_if: []
published_at: "2026-11-09T13:17:05+00:00"
first_seen_at: "2026-11-09T13:26:50+00:00"
updated_at: "2026-11-09T13:28:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118790", "first_seen_at": "2026-11-09T13:26:50+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T13:28:25+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}]
exploit_sources: []
---

# CompuGroup Medical Wingesfar: hardcoded credentials in components and admin functions

Link for people: https://infrastack.ai/live/CVE-2026-118790 (this .md is for agents)

Several product components and admin functions ship with built-in credentials that cannot be changed by the customer. An attacker who knows or finds these credentials can log in to privileged accounts, services, or features on affected deployments.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Wingesfar affected < 2026.07a fixed 2026.07a

## How to check

Check the installed Wingesfar version; anything before 2026.07a is in the affected range. Also check any CGM product (XDent, XMedical, Venere, Phronesis, Infantia, Profim) with your CGM support contact, since the ACN advisory does not map CVEs to products.

## Fix

Wingesfar 2026.07a or later (per the CVE record's affected range; CGM says fixes are pushed automatically to affected installations).

## Timeline

- 2026-11-09T13:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118790
- 2026-11-09T13:28:25+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — NVD record (via API) names CGM Wingesfar < 2026.07a; ACN advisory (v1.1, 6 Nov 2026) lists this CVE among 16 for CGM products without per-CVE mapping or fixed versions; CGM press release says no evidence of exploitation and fixes auto-distributed. No PoC or exploitation found. Exa search and X not available (credits); nothing marked verified because fixed version comes from the CVE record, not the vendor's own words.

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [fix] CGM Italia risolve potenziali vulnerabilità software insieme a CSIRT Italia https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html

## From the sources

Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_