Quick answers
- Is CVE-2026-118467 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118467 being exploited in the wild.
- How severe is CVE-2026-118467?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- CompuGroup Medical CGM STUDIO; CompuGroup Medical WINGESFAR; CompuGroup Medical CGM XMEDICAL.
- Is there a fix for CVE-2026-118467?
- A patch was published on 2026-11-04: Patches distributed automatically prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118467 attacked?
- It is attacked over the network or from the adjacent network.
- Am I affected by CVE-2026-118467?
- Check whether you run CompuGroup Medical CGM Studio, CompuGroup Medical CGM XMEDICAL or CompuGroup Medical WingesFar. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-118467 identifies inadequate pseudonymization and protection of personally identifiable information (PII) in shared telemetry and logging components that handle patient and healthcare provider identifiers, clinical data, and low-entropy tokens. The vulnerability arises from the storage or transmission of sensitive data without cryptographic protection or sufficient anonymization, allowing unauthorized disclosure of protected health information if logs or telemetry streams are intercepted or accessed.
Affected products
- CompuGroup Medical CGM STUDIO
- CompuGroup Medical WINGESFAR
- CompuGroup Medical CGM XMEDICAL
Timeline
- 2026-11-09: disclosed
- 2026-11-04: patched: Patches distributed automatically prior to public disclosure