Is CVE-2026-118462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118462 being exploited in the wild.

How severe is CVE-2026-118462?

Informational severity, published 9 November 2026.

Which products and versions are affected?

CompuGroup Medical pharmacy management software; CompuGroup Medical medical practice management software.

Is there a fix for CVE-2026-118462?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118462 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118462?

Check whether you run CompuGroup Medical Medical Practice Management Software or CompuGroup Medical Pharmacy Management Software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118462: CompuGroup Medical update components code execution without integrity verification

CVE-2026-118462 · Severity: info · Published 2026-11-09

CompuGroup Medical software used by pharmacies and medical practices downloads and executes software updates without properly verifying their authenticity or integrity. An attacker could intercept or forge update packages to inject malicious code that runs with the privileges of the vulnerable application, compromising patient data and system functionality across healthcare facilities.

Vendors: CompuGroup Medical.

Quick answers

Is CVE-2026-118462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118462 being exploited in the wild.
How severe is CVE-2026-118462?: Informational severity, published 9 November 2026.
Which products and versions are affected?: CompuGroup Medical pharmacy management software; CompuGroup Medical medical practice management software.
Is there a fix for CVE-2026-118462?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118462 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118462?: Check whether you run CompuGroup Medical Medical Practice Management Software or CompuGroup Medical Pharmacy Management Software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-118462 affects update mechanisms that fail to cryptographically verify downloaded files, instead relying on weak or forgeable hash values. The vulnerability allows code execution under the update process's privilege level and affects multiple product lines used in pharmacy and medical practice management. Remote exploitation is feasible during update operations without user interaction beyond triggering the automatic update process.

Affected products

CompuGroup Medical pharmacy management software
CompuGroup Medical medical practice management software

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.