XML External Entity Vulnerability in Compugroup Medical Products
CVE-2026-118468

7.2HIGH

Key Information:

Vendor: Compugroup Medical
Status: Infantia; Profim; Phronesis; Venere
Vendor: CVE Published:; 9 November 2026

🔔 Create Compugroup Medical Vulnerability Alert

What is CVE-2026-118468?

This vulnerability pertains to the XML parsers in Compugroup Medical products that process update manifests or network responses with external entity resolution enabled. Attackers can exploit this configuration to launch XML External Entity (XXE) attacks, which could lead to unauthorized access to sensitive data and potentially compromise the entire system.

Affected Version(s)

Infantia 0 <= 6.01.1

Phronesis 0 <= 4.51.0

Profim 0 <= 6.01.1

References

https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-i...

https://www.cgm.com/ita_it/magazine/articles/comunicati-s...

CVSS V4

Score:

7.2

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 9, 2026
Vulnerability Reserved
Oct 28, 2026

Credit

Marco Sala

CSIRT-IT

ApoCert srl

CVE-2026-118468 Data

JSON