Is CVE-2026-118461 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118461 being exploited in the wild.

How severe is CVE-2026-118461?

Informational severity, published 9 November 2026.

Which products and versions are affected?

CompuGroup Medical STUDIO; CompuGroup Medical WINGESFAR; CompuGroup Medical STELLA; CompuGroup Medical XMEDICAL.

Is there a fix for CVE-2026-118461?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118461 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118461?

Check whether you run CompuGroup Medical STELLA, CompuGroup Medical STUDIO, CompuGroup Medical WingesFar or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118461: CompuGroup Medical shared client missing authentication for read/write operations

CVE-2026-118461 · Severity: info · Published 2026-11-09

CompuGroup Medical software used by pharmacies and medical practices lacks authentication controls in a shared client component. An attacker could read or modify patient and professional data by supplying arbitrary identifiers without valid credentials, potentially exposing sensitive healthcare information or altering medical records.

Technologies: CompuGroup Medical WingesFar. Vendors: CompuGroup Medical.

Quick answers

Is CVE-2026-118461 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118461 being exploited in the wild.
How severe is CVE-2026-118461?: Informational severity, published 9 November 2026.
Which products and versions are affected?: CompuGroup Medical STUDIO; CompuGroup Medical WINGESFAR; CompuGroup Medical STELLA; CompuGroup Medical XMEDICAL.
Is there a fix for CVE-2026-118461?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118461 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118461?: Check whether you run CompuGroup Medical STELLA, CompuGroup Medical STUDIO, CompuGroup Medical WingesFar or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication and authorization check in the shared client's read and write operations. The client accepts caller-controlled doctor/professional identifiers without validating credentials, allowing an unauthenticated attacker to perform operations on arbitrary records. This is a direct authentication bypass affecting critical healthcare data operations.

Affected products

CompuGroup Medical STUDIO
CompuGroup Medical WINGESFAR
CompuGroup Medical STELLA
CompuGroup Medical XMEDICAL

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.