CVE-2026-118462
Received Received - Intake

Update Component Download Code Execution Vulnerability

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: ENISA

Description
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-118462

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
CompuGroup Medical Infantia From 0 (inc) to 1.3.0 (inc)
CompuGroup Medical Profim From 0 (inc) to 1.3.0 (inc)
CompuGroup Medical Venere From 0 (inc) to 1.3.0 (inc)
CompuGroup Medical Phronesis From 0 (inc) to 1.3.0 (inc)
CompuGroup Medical Infantia From 0 (inc) to 2.12.0 (inc)
CompuGroup Medical Profim From 0 (inc) to 2.12.0 (inc)
CompuGroup Medical Venere From 0 (inc) to 2.12.0 (inc)
CompuGroup Medical Phronesis From 0 (inc) to 2.12.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves update components that download and execute code without verifying its authenticity. It relies on ignored hashes or forgeable checksums, allowing malicious code to be executed. Some update paths also permit archive traversal or script execution, increasing the risk of compromise.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code on your system by exploiting weak update mechanisms. It may lead to unauthorized access, data theft, or system compromise. Systems using affected CompuGroup Medical components are particularly at risk.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data. Failure to secure update mechanisms may result in non-compliance with data protection and security standards.

Mitigation Strategies

Disable automatic updates that rely on unverified hashes or checksums. Verify the authenticity of all update components before installation. Restrict archive traversal and script execution permissions in update paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...