CVE-2026-118459
AIS PasswordSOS permits authentication without legitimate credentials
CVE-2026-118459 is a medium vulnerability (CVSS 6.3) in Compugroup Medical Infantia, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.
- Severity
- 6.3 MediumCVSS 4.0, CVE List
- Exploit chance
- 0.32%EPSS, 25th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
What each source reports
CVE List Score used
AIS PasswordSOS permits authentication without legitimate credentials
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
- Record
CVE-2026-118459- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-640
- Updated
- 2026-11-09
EUVDEUVD-2026-120021
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
- Record
EUVD-2026-120021- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-57r9-h7hp-fw88
A time-derived emergency password can be derived from publicly available application code,...
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
- Record
GHSA-57r9-h7hp-fw88- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-640
- Updated
- 2026-11-09
NVD
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
- Record
CVE-2026-118459- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-640
- Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, published | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html
acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
nvd.nist.gov/vuln/detail/CVE-2026-118459
github.com/advisories/GHSA-57r9-h7hp-fw88