Is CVE-2026-112172 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112172 being exploited in the wild.

How severe is CVE-2026-112172?

Informational severity, published 9 November 2026.

Which products and versions are affected?

CompuGroup Medical XDent; CompuGroup Medical XMedical.

How is CVE-2026-112172 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112172?

Check whether you run CompuGroup Medical XDent or CompuGroup Medical XMedical. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112172: CompuGroup Medical XDent and XMedical unauthenticated SQL injection

CVE-2026-112172 · Severity: info · Published 2026-11-09

CGM XDent and XMedical are healthcare management systems used by dental practices, medical clinics, and pharmacies to manage patient records and operations. The software exposes PHP synchronization endpoints without authentication, allowing attackers to manipulate session variables and execute arbitrary SQL queries against backend databases. This could lead to unauthorized access to sensitive patient data, modification of medical records, and compromise of healthcare facility operations.

Vendors: CompuGroup Medical.

Quick answers

Is CVE-2026-112172 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112172 being exploited in the wild.
How severe is CVE-2026-112172?: Informational severity, published 9 November 2026.
Which products and versions are affected?: CompuGroup Medical XDent; CompuGroup Medical XMedical.
Is there a fix for CVE-2026-112172?: No fixed version is recorded yet. Ensure the affected systems are fully updated with the automatic patches distributed by CompuGroup Medical. Restrict network access to synchronization endpoints and implement Web Application Firewall rules to detect and block SQL injection attempts. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112172 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112172?: Check whether you run CompuGroup Medical XDent or CompuGroup Medical XMedical. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Ensure the affected systems are fully updated with the automatic patches distributed by CompuGroup Medical. Restrict network access to synchronization endpoints and implement Web Application Firewall rules to detect and block SQL injection attempts.

Technical details

Unauthenticated PHP synchronization endpoints in XDent and XMedical accept controllable identifiers without requiring valid credentials, permitting arbitrary read and write operations. An attacker can exploit missing authentication controls on the shared client component to execute SQL injection attacks against the backend MySQL database. No authentication or user interaction is required; the vulnerability is accessible over the network.

Affected products

CompuGroup Medical XDent
CompuGroup Medical XMedical

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.