{"id":"CVE-2026-112168","aliases":[],"cve":{"records":[{"id":"CVE-2026-112168","source":"ENISA","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T08:06:39.208Z","published":"2026-11-09T12:34:24.511Z","modified":"2026-11-12T16:08:46.068Z"}],"publishers":[{"name":"ENISA","role":"CNA","organizationId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","modified":"2026-11-09T12:34:24.511Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T16:08:46.068Z"}],"references":[{"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra","tags":["government-resource"],"source":"ENISA"}],"weaknesses":[{"id":"CWE-312","description":"CWE-312 Cleartext storage of sensitive information","source":"ENISA"},{"id":"CWE-798","description":"CWE-798 Use of hard-coded credentials","source":"ENISA"},{"id":"CWE-261","description":"CWE-261 Weak encoding for password","source":"ENISA"},{"id":"CWE-327","description":"CWE-327 Use of a broken or risky cryptographic algorithm","source":"ENISA"}],"applicability":[{"source":"ENISA","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:galeno_sistemi:magistra:3.12:*:windows:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:08:32.010633Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Multiple embedded secrets and weak algorithms in Magistra","titleSource":"ENISA","descriptionSource":"ENISA","description":"The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.","score":6,"severity":"medium","published":"2026-11-09T12:34:24.511Z","modified":"2026-11-12T16:08:46.068Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"GALENO SISTEMI","name":"MAGISTRA","platforms":["Windows"],"versions":[{"version":"3.12","status":"affected","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-112168"}],"remediation":[],"references":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"],"sources":[{"name":"CVE","id":"CVE-2026-112168","modified":"2026-11-12T16:08:46.068Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112168"}],"assessments":[{"source":"ENISA","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":6}],"sourceAffected":[],"observedAt":"2026-11-12T23:58:02.799Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T12:45:37.125Z","attemptedAt":"2026-11-09T12:45:37.125Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T12:45:37.070Z","attemptedAt":"2026-11-09T12:45:37.070Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T12:45:38.022Z","attemptedAt":"2026-11-09T12:45:38.022Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T12:45:36.919Z","attemptedAt":"2026-11-09T12:45:36.919Z"}],"evidence":[],"aiSummary":{"text":"Magistra 3.12 uses weak custom encryption and outdated compression, and contains embedded secrets. An attacker with access may exploit these weaknesses. Impact is unclear.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:41:01.041Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112168"}]}}