{"id":"CVE-2026-118462","aliases":[],"cve":{"records":[{"id":"CVE-2026-118462","source":"ENISA","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T08:46:25.411Z","published":"2026-11-09T11:51:58.643Z","modified":"2026-11-12T19:59:56.693Z"}],"publishers":[{"name":"ENISA","role":"CNA","organizationId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","modified":"2026-11-09T11:51:58.643Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T19:59:56.693Z"}],"references":[{"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","tags":[],"source":"ENISA"},{"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","tags":[],"source":"ENISA"}],"weaknesses":[{"id":"CWE-494","description":"CWE-494","source":"ENISA"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T19:58:38.503243Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"AIS update mechanism executes unverified code","titleSource":"ENISA","descriptionSource":"ENISA","description":"Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.","score":9.2,"severity":"critical","published":"2026-11-09T11:51:58.643Z","modified":"2026-11-12T19:59:56.693Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"CompuGroup Medical","name":"Infantia","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Profim","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Venere","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Phronesis","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.3.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Infantia","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.12.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Profim","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.12.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Venere","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.12.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"},{"vendor":"CompuGroup Medical","name":"Phronesis","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.12.0","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"}],"remediation":[],"references":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"],"sources":[{"name":"CVE","id":"CVE-2026-118462","modified":"2026-11-12T19:59:56.693Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"}],"assessments":[{"source":"ENISA","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.2}],"sourceAffected":[],"observedAt":"2026-11-13T09:46:36.284Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:10:34.932Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T12:05:34.969Z","attemptedAt":"2026-11-09T12:05:34.969Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T12:05:34.644Z","attemptedAt":"2026-11-09T12:05:34.644Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T12:05:35.029Z","attemptedAt":"2026-11-09T12:05:35.029Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T12:05:35.299Z","attemptedAt":"2026-11-09T12:05:35.299Z"}],"evidence":[],"aiSummary":{"text":"CompuGroup Medical products Infantia, Profim, Venere, and Phronesis, versions up to 1.3.0 and 2.12.0, have an update mechanism that executes unverified code. The mechanism relies on ignored hashes or forgeable checksums. This may permit archive traversal or script execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:06:04.937Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"}]}}