{"id":"CVE-2026-118791","kind":"vulnerability","aliases":["CVE-2026-118791"],"related":[],"title":"CompuGroup Medical Wingesfar accepts update packages without verifying authenticity or integrity","description":"The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.","summary":"Wingesfar, CompuGroup Medical's (CGM Italia) pharmacy management software, accepts update packages without sufficient cryptographic verification of authenticity and integrity. An attacker able to replace an update package could get malicious content installed. CSIRT Italia lists versions before 2026.07a as affected. CGM says fixes are distributed automatically to affected installations and that its analysis found no evidence of exploitation.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Wingesfar","fixed":["2026.07a"],"affected":"< 2026.07a","ecosystem":"vendor"}],"ecosystems":[],"tags":["compugroup-medical","other","pharmacy","self-hosted","software-update","wingesfar"],"not_affected_if":[],"how_to_check":"Check the installed Wingesfar version; versions before 2026.07a are listed as affected by CSIRT Italia (NVD data showed a differing 'before 10.2.1', unconfirmed). Confirm with CGM customer service that the automatic update has reached your installation.","fix":"Update Wingesfar to 2026.07a or later (inferred from the CSIRT Italia range; the advisory names no fixed version). CSIRT Italia advises updating through the support channels agreed with CGM; CGM says fixes are distributed automatically.","status":"open","published_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:30+00:00","updated_at":"2026-11-09T13:28:41+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T13:27:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Application accepts software updates without verifying authenticity or integrity","impact":"high","summary":"The application installs update packages without checking their cryptographic signature or integrity. An attacker who can deliver a malicious update package may get code run inside the application.","audience":"businesses","category":"other","nicknames":[],"who_cares":["self-hosted"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker-supplied update code runs with the application's privileges","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118791; the description names no product.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected application, its versions, or the update channel. Teams that run the application with auto-update or update from a network path an attacker could influence should treat it as relevant until the product is identified.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4488,"output_tokens":398,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118791; the description names no product.","search":"'-118791':14A,17A '-2026':13A,16A '2026.07':69B 'abl':53B 'accept':4A,40B,108C 'adequ':98C 'affect':72B,80B 'allow':103C 'analysi':85B 'applic':92C 'attack':52B 'authent':9A,48B,99C 'automat':78B 'cgm':35B,73B 'compugroup':1A,20B,32B 'compugroup-med':19B 'content':62B 'could':59B 'cryptograph':45B,111C 'csirt':64B 'cve':12A,15A 'distribut':77B 'evid':88B 'exploit':90B 'fix':75B 'found':86B 'function':96C 'get':60B 'host':26B 'implement':93C 'instal':63B,81B 'integr':11A,50B,101C 'italia':36B,65B 'list':66B 'malici':61B 'manag':38B 'medic':2A,21B,33B 'packag':6A,42B,58B,105C 'pharmaci':23B,37B 'replac':55B 'say':74B 'self':25B 'self-host':24B 'softwar':28B,39B,94C 'software-upd':27B 'suffici':44B,110C 'updat':5A,29B,41B,57B,95C,104C 'valid':102C 'verif':46B,112C 'verifi':8A 'version':67B 'wingesfar':3A,18A,30B,31B 'without':7A,43B,97C,109C","nicknames":[],"mitigations":[],"who_affected":"Pharmacies running CompuGroup Medical Wingesfar earlier than 2026.07a, per CSIRT Italia. The attacker needs to be able to tamper with the update path (for example from a position on the network or the update server), so installations updating over untrusted networks matter most. Installations already on 2026.07a or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wingesfar"],"ptokens":["wingesfar"],"labels":["compugroupmedical","high","other","pharmacy","selfhosted","softwareupdate","wingesfar"],"campaign_type":null,"search_a":"'-118791':14A,17A '-2026':13A,16A 'accept':4A 'authent':9A 'compugroup':1A 'cve':12A,15A 'integr':11A 'medic':2A 'packag':6A 'updat':5A 'verifi':8A 'wingesfar':3A,18A 'without':7A","search_b":"'2026.07':69B 'abl':53B 'accept':40B 'affect':72B,80B 'analysi':85B 'attack':52B 'authent':48B 'automat':78B 'cgm':35B,73B 'compugroup':20B,32B 'compugroup-med':19B 'content':62B 'could':59B 'cryptograph':45B 'csirt':64B 'distribut':77B 'evid':88B 'exploit':90B 'fix':75B 'found':86B 'get':60B 'host':26B 'instal':63B,81B 'integr':50B 'italia':36B,65B 'list':66B 'malici':61B 'manag':38B 'medic':21B,33B 'packag':42B,58B 'pharmaci':23B,37B 'replac':55B 'say':74B 'self':25B 'self-host':24B 'softwar':28B,39B 'software-upd':27B 'suffici':44B 'updat':29B,41B,57B 'verif':46B 'version':67B 'wingesfar':30B,31B 'without':43B","search_c":"'accept':108C 'adequ':98C 'allow':103C 'applic':92C 'authent':99C 'cryptograph':111C 'function':96C 'implement':93C 'integr':101C 'packag':105C 'softwar':94C 'suffici':110C 'updat':95C,104C 'valid':102C 'verif':112C 'without':97C,109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118791","severity":null,"published_at":"2026-11-09T13:17:05+00:00","modified_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118791:2291","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T13:28:41+00:00","modified_at":"2026-11-09T13:28:41+00:00","first_seen_at":"2026-11-09T13:28:41+00:00","fetched_at":"2026-11-09T13:28:41+00:00","note":"Product found via NVD API (no CPE): CompuGroup Medical Wingesfar. Read CSIRT Italia advisory (range < 2026.07a, no named fix) and CGM press release (no versions, no exploitation evidence, auto-distributed fixes). NVD fetch via summarizer gave a conflicting 'before 10.2.1', unresolved. Nothing marked verified: ACN is not the vendor and CGM names no versions. Exa search and X not used (credits out).","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107410,"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","title":"CGM Italia risolve potenziali vulnerabilità software insieme a CSIRT Italia","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}