# CVE-2026-118465: CompuGroup Medical shared components hard-coded credentials

Source: https://junglewise.ai/threats/cve-2026-118465-shared-components-expose-hard-coded-access-workgroup-ccbasic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-118465 · Severity: info · Published 2026-11-09

CompuGroup Medical software used by pharmacies and medical offices contains hard-coded database credentials (for Access, CCBasic, DBISAM, and workgroup databases) that are identical across all installations. An attacker with access to the software could extract these credentials and gain unauthorized access to patient records, prescriptions, and sensitive medical information stored in these databases across multiple healthcare facilities.

Vendors: [CompuGroup Medical](https://junglewise.ai/threats/vendors/compugroup-medical).

## Quick answers

**Is CVE-2026-118465 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118465 being exploited in the wild.

**How severe is CVE-2026-118465?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** CompuGroup Medical pharmacy and medical office management software.

**Is there a fix for CVE-2026-118465?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118465 attacked?** It is attacked with local access or from the adjacent network.

**Am I affected by CVE-2026-118465?** Check whether you run CompuGroup Medical Pharmacy And Medical Office Management Software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CVE-2026-118465) is a use of hard-coded credentials flaw in shared database components. Attackers can extract the embedded Access, CCBasic, DBISAM, and workgroup database credentials from the software binaries or memory, which are reused identically across installations, allowing database access without authentication. No patch details are provided in the advisory.

## Affected products

- CompuGroup Medical pharmacy and medical office management software

## References

- [https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical](https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical)
- [https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html](https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html)