Quick answers
- Is CVE-2026-118459 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118459 being exploited in the wild.
- How severe is CVE-2026-118459?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- CompuGroup Medical Pharmacy Management Software; CompuGroup Medical Medical Practice Management Software.
- Is there a fix for CVE-2026-118459?
- A patch was published on 2026-11-04: Patches distributed automatically to all installations Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118459 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-118459?
- Check whether you run CompuGroup Medical Medical Practice Management Software or CompuGroup Medical Pharmacy Management Software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the password reset procedure where emergency passwords are generated based on time-derived values that can be computed from publicly available application code. This weak password recovery mechanism allows an unauthenticated attacker to derive valid credentials without legitimate password reset authorization, gaining direct access to the affected healthcare management systems.
Affected products
- CompuGroup Medical Pharmacy Management Software
- CompuGroup Medical Medical Practice Management Software
Timeline
- 2026-11-04: disclosed
- 2026-11-04: patched: Patches distributed automatically to all installations