CVE-2026-118462 AIS update mechanism executes unverified code

CriticalCVSS 9.2

Published: 2026-11-09 13:51
Updated: 2026-11-09 13:51
Exploit status: No public exploit known

Description

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

Affected products

Product	Affected versions	Fixed in
CompuGroup Medical Infantia	<= 1.3.0	No fix listed
CompuGroup Medical Profim	<= 1.3.0	No fix listed
CompuGroup Medical Venere	<= 1.3.0	No fix listed
CompuGroup Medical Phronesis	<= 1.3.0	No fix listed
CompuGroup Medical Infantia	<= 2.12.0	No fix listed
CompuGroup Medical Profim	<= 2.12.0	No fix listed
CompuGroup Medical Venere	<= 2.12.0	No fix listed
CompuGroup Medical Phronesis	<= 2.12.0	No fix listed

References

CVSS v4.0

9.2 Critical

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: High
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-494

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.