Quick answers
- Is CVE-2026-118460 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118460 being exploited in the wild.
- How severe is CVE-2026-118460?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- CompuGroup Medical software for pharmacy and medical practice management.
- Is there a fix for CVE-2026-118460?
- A patch was published on 2026-11-04: Patches distributed automatically to all installations before public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118460 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-118460?
- Check whether you run CompuGroup Medical Software For Pharmacy And Medical Practice Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-118460 is a hardcoded cryptographic key vulnerability where embedded private keys are protected only by a shared password. An attacker with access to the compiled code or software packages can extract these keys and use them to digitally sign practitioner identity assertions (tokens) for arbitrary practitioner identifiers, bypassing authentication controls. This affects multiple CompuGroup Medical products across pharmacy and medical practice management systems.
Affected products
- CompuGroup Medical software for pharmacy and medical practice management
Timeline
- 2026-11-09: disclosed: Coordinated disclosure via CSIRT Italia following NIS2 procedure
- 2026-11-04: patched: Patches distributed automatically to all installations before public disclosure