{"id":"CVE-2026-118791","aliases":[],"cve":{"records":[{"id":"CVE-2026-118791","source":"ENISA","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T19:53:57.995Z","published":"2026-11-09T12:03:10.247Z","modified":"2026-11-12T16:05:56.868Z"}],"publishers":[{"name":"ENISA","role":"CNA","organizationId":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","modified":"2026-11-09T12:03:10.247Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T16:05:56.868Z"}],"references":[{"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","tags":[],"source":"ENISA"},{"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","tags":[],"source":"ENISA"}],"weaknesses":[{"id":"CWE-494","description":"CWE-494","source":"ENISA"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:05:26.447064Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Insecure software update mechanism","titleSource":"ENISA","descriptionSource":"ENISA","description":"The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.","score":7.2,"severity":"high","published":"2026-11-09T12:03:10.247Z","modified":"2026-11-12T16:05:56.868Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"CompuGroup Medical","name":"Wingesfar","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"10.2.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"ENISA","url":"https://www.cve.org/CVERecord?id=CVE-2026-118791"}],"remediation":[],"references":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"],"sources":[{"name":"CVE","id":"CVE-2026-118791","modified":"2026-11-12T16:05:56.868Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118791"}],"assessments":[{"source":"ENISA","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":7.2}],"sourceAffected":[],"observedAt":"2026-11-12T23:58:20.364Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T12:40:34.162Z","attemptedAt":"2026-11-09T12:40:34.162Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T12:40:34.332Z","attemptedAt":"2026-11-09T12:40:34.332Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T12:40:33.656Z","attemptedAt":"2026-11-09T12:40:33.656Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T12:40:34.868Z","attemptedAt":"2026-11-09T12:40:34.868Z"}],"evidence":[],"aiSummary":{"text":"CompuGroup Medical's Wingesfar application, version 0 to less than 10.2.1, has an insecure software update mechanism, lacking adequate authenticity and integrity validation. This allows update packages to be accepted without sufficient cryptographic verification. An attacker with access to the update process may exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T12:21:08.756Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118791"}]}}