WINGESFAR · CVE-2026-118791 · Other
FIX → 2026.07a
Wingesfar, CompuGroup Medical's (CGM Italia) pharmacy management software, accepts update packages without sufficient cryptographic verification of authenticity and integrity. An attacker able to replace an update package could get malicious content installed. CSIRT Italia lists versions before 2026.07a as affected. CGM says fixes are distributed automatically to affected installations and that its analysis found no evidence of exploitation.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Pharmacies running CompuGroup Medical Wingesfar earlier than 2026.07a, per CSIRT Italia. The attacker needs to be able to tamper with the update path (for example from a position on the network or the update server), so installations updating over untrusted networks matter most. Installations already on 2026.07a or later can skip it.
Who cares compugroup-medical, pharmacy, self-hosted, software-update, wingesfar
before 10.2.1, unconfirmed)Upgrade to 2026.07a
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.