# CVE-2026-118467: CompuGroup Medical telemetry logging data exposure

Source: https://junglewise.ai/threats/cve-2026-118467-shared-telemetry-and-logging-components-store-or-transmit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-118467 · Severity: info · Published 2026-11-09

CompuGroup Medical software used by pharmacies and medical clinics stores patient and doctor identifiers along with clinical information in telemetry and logging systems without proper protection. An attacker gaining access to these logs could extract sensitive healthcare records, potentially compromising patient privacy and enabling identity theft or fraud.

Technologies: [CompuGroup Medical CGM Studio](https://junglewise.ai/threats/technologies/cgm-studio), [CompuGroup Medical WingesFar](https://junglewise.ai/threats/technologies/wingesfar). Vendors: [CompuGroup Medical](https://junglewise.ai/threats/vendors/compugroup-medical).

## Quick answers

**Is CVE-2026-118467 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118467 being exploited in the wild.

**How severe is CVE-2026-118467?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** CompuGroup Medical CGM STUDIO; CompuGroup Medical WINGESFAR; CompuGroup Medical CGM XMEDICAL.

**Is there a fix for CVE-2026-118467?** A patch was published on 2026-11-04: Patches distributed automatically prior to public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118467 attacked?** It is attacked over the network or from the adjacent network.

**Am I affected by CVE-2026-118467?** Check whether you run CompuGroup Medical CGM Studio, CompuGroup Medical CGM XMEDICAL or CompuGroup Medical WingesFar. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-118467 identifies inadequate pseudonymization and protection of personally identifiable information (PII) in shared telemetry and logging components that handle patient and healthcare provider identifiers, clinical data, and low-entropy tokens. The vulnerability arises from the storage or transmission of sensitive data without cryptographic protection or sufficient anonymization, allowing unauthorized disclosure of protected health information if logs or telemetry streams are intercepted or accessed.

## Affected products

- CompuGroup Medical CGM STUDIO
- CompuGroup Medical WINGESFAR
- CompuGroup Medical CGM XMEDICAL

## Timeline

- 2026-11-09: disclosed
- 2026-11-04: patched: Patches distributed automatically prior to public disclosure

## References

- [https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical](https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical)
- [https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html](https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html)

## Related threats

- [CompuGroup Medical multiple products authentication and cryptographic vulnerabilities](https://junglewise.ai/threats/cve-2026-118798-multiple-sensitive-authentication-data-including-credentials)
- [CompuGroup Medical products hardcoded credentials in administrative functions](https://junglewise.ai/threats/cve-2026-118790-multiple-hardcoded-credentials-are-embedded-within-product)
- [CompuGroup Medical shared client missing authentication for read/write operations](https://junglewise.ai/threats/cve-2026-118461-the-shared-client-accepts-caller-controlled-doctor-identifiers)
- [CompuGroup Medical AIS login authentication bypass using hardcoded credentials](https://junglewise.ai/threats/cve-2026-118458-the-shared-ais-login-routing-selects-a-production-shipped-test)