Is CVE-2026-118795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118795 being exploited in the wild.

How severe is CVE-2026-118795?

Informational severity, published 9 November 2026.

Which products and versions are affected?

CompuGroup Medical CGM Italia pharmacy and medical practice software.

Is there a fix for CVE-2026-118795?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118795 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-118795?

Check whether you run CompuGroup Medical CGM Italia pharmacy and medical practice software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118795: CompuGroup Medical administrative roles privilege escalation via database

CVE-2026-118795 · Severity: info · Published 2026-11-09

CompuGroup Medical software used by pharmacies and medical practices stores administrative roles and permissions in a local database that can be modified. An attacker with write access to the database could escalate their privileges to gain administrative control and access sensitive patient or operational data.

Vendors: CompuGroup Medical.

Quick answers

Is CVE-2026-118795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118795 being exploited in the wild.
How severe is CVE-2026-118795?: Informational severity, published 9 November 2026.
Which products and versions are affected?: CompuGroup Medical CGM Italia pharmacy and medical practice software.
Is there a fix for CVE-2026-118795?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118795 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-118795?: Check whether you run CompuGroup Medical CGM Italia pharmacy and medical practice software. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability involves improper storage of administrative roles and module permissions in mutable local database fields. An attacker with database write access can modify these fields to escalate privileges. This is a post-authentication privilege escalation attack requiring prior database compromise.

Affected products

CompuGroup Medical CGM Italia pharmacy and medical practice software

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.