---
id: "CVE-2026-118791"
page: "https://infrastack.ai/live/CVE-2026-118791"
kind: "vulnerability"
aliases: ["CVE-2026-118791"]
title: "CompuGroup Medical Wingesfar accepts update packages without verifying authenticity or integrity"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Wingesfar", "fixed": ["2026.07a"], "affected": "< 2026.07a", "ecosystem": "vendor"}]
ecosystems: []
tags: ["compugroup-medical", "other", "pharmacy", "self-hosted", "software-update", "wingesfar"]
not_affected_if: []
published_at: "2026-11-09T13:17:05+00:00"
first_seen_at: "2026-11-09T13:26:50+00:00"
updated_at: "2026-11-09T13:28:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118791", "first_seen_at": "2026-11-09T13:26:50+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T13:28:41+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"]}]
exploit_sources: []
---

# CompuGroup Medical Wingesfar accepts update packages without verifying authenticity or integrity

Link for people: https://infrastack.ai/live/CVE-2026-118791 (this .md is for agents)

Wingesfar, CompuGroup Medical's (CGM Italia) pharmacy management software, accepts update packages without sufficient cryptographic verification of authenticity and integrity. An attacker able to replace an update package could get malicious content installed. CSIRT Italia lists versions before 2026.07a as affected. CGM says fixes are distributed automatically to affected installations and that its analysis found no evidence of exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Wingesfar affected < 2026.07a fixed 2026.07a

## How to check

Check the installed Wingesfar version; versions before 2026.07a are listed as affected by CSIRT Italia (NVD data showed a differing 'before 10.2.1', unconfirmed). Confirm with CGM customer service that the automatic update has reached your installation.

## Fix

Update Wingesfar to 2026.07a or later (inferred from the CSIRT Italia range; the advisory names no fixed version). CSIRT Italia advises updating through the support channels agreed with CGM; CGM says fixes are distributed automatically.

## Timeline

- 2026-11-09T13:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118791
- 2026-11-09T13:28:41+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — Product found via NVD API (no CPE): CompuGroup Medical Wingesfar. Read CSIRT Italia advisory (range < 2026.07a, no named fix) and CGM press release (no versions, no exploitation evidence, auto-distributed fixes). NVD fetch via summarizer gave a conflicting 'before 10.2.1', unresolved. Nothing marked verified: ACN is not the vendor and CGM names no versions. Exa search and X not used (credits out).

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [fix] CGM Italia risolve potenziali vulnerabilità software insieme a CSIRT Italia https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html

## From the sources

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_