Code Execution Vulnerability in Compugroup Medical Software
CVE-2026-118462

9.2CRITICAL

Key Information:

Vendor

Compugroup Medical

Status
Infantia
Profim
Venere
Phronesis
Vendor
CVE Published:
9 November 2026

What is CVE-2026-118462?

The vulnerability presents a serious risk within Compugroup Medical software, where the updating mechanism allows for code execution without adequate authenticity verification. This issue arises from reliance on potentially compromised hashes and checksums, enabling unauthorized code to be executed. Furthermore, certain update pathways may permit archive traversal, or even the execution of malicious scripts, exposing users to significant security threats.

Affected Version(s)

Infantia 0 <= 1.3.0

Infantia 0 <= 2.12.0

Phronesis 0 <= 1.3.0

References

https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-i...
https://www.cgm.com/ita_it/magazine/articles/comunicati-s...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Sala
CSIRT-IT
ApoCert srl
.