{"affected":[{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Infantia","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Profim","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Venere","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Phronesis","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Infantia","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Profim","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Venere","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Phronesis","source":"CNA: ENISA","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118462","cwes":["CWE-494"],"description":"Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.2,"severity":"critical","source":"CNA: ENISA","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794225118643,"publishedAt":1794225118643,"references":[{"source":"CNA: ENISA","tags":[],"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"CNA: ENISA","tags":[],"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"remediation":[],"revision":"d6645dad6ab0987c79f5b4f9ce60ddf5d777976134c4cee31ee178f90ac6bd2c","sources":[{"modifiedAt":1794225118643,"name":"CNA: ENISA","retrievedAt":1794226114818,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118462"}],"ssvc":null,"status":"published","title":"AIS update mechanism executes unverified code","updatedAt":1794226114818}