Is CVE-2026-118458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118458 being exploited in the wild.

How severe is CVE-2026-118458?

Informational severity, published 9 November 2026.

Which products and versions are affected?

CompuGroup Medical CGM Studio; CompuGroup Medical WingesFar; CompuGroup Medical Apodesk; CompuGroup Medical CGM Stella Store.

Is there a fix for CVE-2026-118458?

A patch was published on 2026-11-04: Patches distributed automatically to all installations Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118458 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118458?

Check whether you run CompuGroup Medical Apodesk, CompuGroup Medical CGM Stella Store, CompuGroup Medical CGM Studio or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118458: CompuGroup Medical AIS login authentication bypass using hardcoded credentials

CVE-2026-118458 · Severity: info · Published 2026-11-09

CompuGroup Medical's pharmacy and medical practice management software contains hardcoded administrator credentials and uses a test authentication routine in production that compares credentials in plaintext. An attacker can bypass login controls and gain administrative access to patient records, pharmacy systems, and medical practice data without legitimate credentials.

Technologies: CompuGroup Medical Apodesk, CompuGroup Medical CGM Studio, CompuGroup Medical WingesFar. Vendors: CompuGroup Medical.

Quick answers

Is CVE-2026-118458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118458 being exploited in the wild.
How severe is CVE-2026-118458?: Informational severity, published 9 November 2026.
Which products and versions are affected?: CompuGroup Medical CGM Studio; CompuGroup Medical WingesFar; CompuGroup Medical Apodesk; CompuGroup Medical CGM Stella Store.
Is there a fix for CVE-2026-118458?: A patch was published on 2026-11-04: Patches distributed automatically to all installations Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118458 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118458?: Check whether you run CompuGroup Medical Apodesk, CompuGroup Medical CGM Stella Store, CompuGroup Medical CGM Studio or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A test Data Access Object (DAO) with hardcoded credentials was shipped in production code, and plaintext credential comparison for specific application codes (H and V) accepts fixed administrator accounts. This allows unauthenticated remote attackers to authenticate as administrators. No authentication or authorization checks validate the caller's identity before granting access.

Affected products

CompuGroup Medical CGM Studio
CompuGroup Medical WingesFar
CompuGroup Medical Apodesk
CompuGroup Medical CGM Stella Store

Timeline

2026-11-04: disclosed
2026-11-04: patched: Patches distributed automatically to all installations

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.