{"id":"CVE-2026-112170","aliases":[],"cve":{"records":[{"id":"CVE-2026-112170","source":"ENISA","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T08:06:39.208Z","published":"2026-11-09T12:38:47.727Z","modified":"2026-11-12T16:09:52.614Z"}],"publishers":[{"name":"ENISA","role":"CNA","organizationId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","modified":"2026-11-09T12:38:47.727Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T16:09:52.614Z"}],"references":[{"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra","tags":[],"source":"ENISA"}],"weaknesses":[{"id":"CWE-306","description":"CWE-306 Missing authentication for critical function","source":"ENISA"},{"id":"CWE-494","description":"CWE-494 Download of code without integrity check","source":"ENISA"},{"id":"CWE-427","description":"CWE-427 Uncontrolled search path element","source":"ENISA"}],"applicability":[{"source":"ENISA","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:galeno_sistemi:magistra:3.12:*:windows:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:09:40.820363Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Improper verification of downloaded upgrades","titleSource":"ENISA","descriptionSource":"ENISA","description":"The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.","score":6.3,"severity":"medium","published":"2026-11-09T12:38:47.727Z","modified":"2026-11-12T16:09:52.614Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"GALENO SISTEMI","name":"MAGISTRA","platforms":["Windows"],"versions":[{"version":"3.12","status":"affected","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-112170"}],"remediation":[],"references":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"],"sources":[{"name":"CVE","id":"CVE-2026-112170","modified":"2026-11-12T16:09:52.614Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112170"}],"assessments":[{"source":"ENISA","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":6.3}],"sourceAffected":[],"observedAt":"2026-11-12T23:58:06.350Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T12:55:31.758Z","attemptedAt":"2026-11-09T12:55:31.758Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T12:55:31.758Z","attemptedAt":"2026-11-09T12:55:31.758Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T12:55:31.758Z","attemptedAt":"2026-11-09T12:55:31.758Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T12:55:31.758Z","attemptedAt":"2026-11-09T12:55:31.758Z"}],"evidence":[],"aiSummary":{"text":"GALENO SISTEMI MAGISTRA 3.12 for Windows may allow tampered updates due to missing integrity checks on downloaded upgrades. An attacker with access to the upgrade download process could exploit this weakness. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:46:03.057Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112170"}]}}