CVE-2026-26928

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26928", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-02-16T09:01:03.143Z", "datePublished": "2026-04-02T14:01:42.262Z", "dateUpdated": "2026-04-02T14:21:50.711Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SzafirHost", "vendor": "Krajowa Izba Rozliczeniowa", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Leszczy\u0144ski"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SzafirHost&nbsp;downloads necessary files in the context of the <span style=\"background-color: rgb(255, 255, 255);\">initiating web page.</span>&nbsp;When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">DLL, SO, JNILIB or DYLIB</span> file. The attacker can provide malicious file which will be saved in users /temp folder&nbsp;<span style=\"background-color: rgba(221, 223, 228, 0.04);\">and executed by the application.</span><br><br>This issue was fixed in version 1.1.0."}], "value": "SzafirHost\u00a0downloads necessary files in the context of the initiating web page.\u00a0When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded\u00a0DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder\u00a0and executed by the application.\n\nThis issue was fixed in version 1.1.0."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-02T14:01:42.262Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2026/04/CVE-2026-26927"}, {"tags": ["product"], "url": "https://www.elektronicznypodpis.pl/"}], "source": {"discovery": "EXTERNAL"}, "title": "Lack of Dynamic Library Validation in SzafirHost", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T14:21:35.804676Z", "id": "CVE-2026-26928", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:21:50.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26928", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T14:21:35.804676Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:21:42.248Z"}}], "cna": {"title": "Lack of Dynamic Library Validation in SzafirHost", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Leszczy\u0144ski"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Krajowa Izba Rozliczeniowa", "product": "SzafirHost", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/posts/2026/04/CVE-2026-26927", "tags": ["third-party-advisory"]}, {"url": "https://www.elektronicznypodpis.pl/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "SzafirHost\u00a0downloads necessary files in the context of the initiating web page.\u00a0When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded\u00a0DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder\u00a0and executed by the application.\n\nThis issue was fixed in version 1.1.0.", "supportingMedia": [{"type": "text/html", "value": "SzafirHost&nbsp;downloads necessary files in the context of the <span style=\"background-color: rgb(255, 255, 255);\">initiating web page.</span>&nbsp;When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">DLL, SO, JNILIB or DYLIB</span> file. The attacker can provide malicious file which will be saved in users /temp folder&nbsp;<span style=\"background-color: rgba(221, 223, 228, 0.04);\">and executed by the application.</span><br><br>This issue was fixed in version 1.1.0.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-02T14:01:42.262Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26928", "state": "PUBLISHED", "dateUpdated": "2026-04-02T14:21:50.711Z", "dateReserved": "2026-02-16T09:01:03.143Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-04-02T14:01:42.262Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SzafirHost", "vendor": "Krajowa Izba Rozliczeniowa", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SzafirHost\u00a0downloads necessary files in the context of the initiating web page.\u00a0When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded\u00a0DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder\u00a0and executed by the application.\n\nThis issue was fixed in version 1.1.0."}, {"lang": "es", "value": "SzafirHost descarga los archivos necesarios en el contexto de la p\u00e1gina web iniciadora. Cuando se le llama, SzafirHost actualiza su biblioteca din\u00e1mica. Los archivos JAR se verifican correctamente bas\u00e1ndose en una lista de hashes de archivos de confianza, y si un archivo no estaba en esa lista, se comprobaba si hab\u00eda sido firmado digitalmente por el proveedor. La aplicaci\u00f3n no verifica el hash ni la firma digital del proveedor de los archivos DLL, SO, JNILIB o DYLIB cargados. El atacante puede proporcionar un archivo malicioso que se guardar\u00e1 en la carpeta /temp del usuario y ser\u00e1 ejecutado por la aplicaci\u00f3n.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 1.1.0."}], "id": "CVE-2026-26928", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26928", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T14:21:35.804676Z", "version": "2.0.3"}}]}, "published": "2026-04-02T14:16:26.077", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/04/CVE-2026-26927"}, {"source": "cvd@cert.pl", "url": "https://www.elektronicznypodpis.pl/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SzafirHost", "source": "cna", "vendor": "Krajowa Izba Rozliczeniowa"}, "product": "szafirhost", "vendor": "krajowa_izba_rozliczeniowa"}], "analysis": {"en": {"generated_at": "2026-04-02T15:22:55.021006+00:00", "value": {"mitigation_remediation": ["Upgrade SzafirHost to version 1.1.0 or later."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects installations of SzafirHost from Krajowa Izba Rozliczeniowa that are running versions earlier than 1.1.0. Any deployment that allows the web context to trigger dynamic library updates without proper validation is subject to this vulnerability.", "description_and_impact": "The flaw resides in SzafirHost\u2019s handling of uploaded dynamic libraries. While JAR files are guarded by hash checking and vendor signatures, the software does not perform any verification for DLL, SO, JNILIB, or DYLIB files. A malicious actor can supply an invalid library that the application will load and execute, allowing arbitrary code to run with the privileges of the host process. The vulnerability therefore enables a remote attacker to compromise confidentiality, integrity, and availability of the affected system.", "risk_and_exploitability": "With a CVSS score of 8.7 the vulnerability is classified as high severity. The EPSS score is not available, and it is not listed in CISA\u2019s KEV catalog. The attack can be performed remotely by submitting a crafted DLL, SO, JNILIB, or DYLIB through the web interface that initiates library updates. While no public exploit has been detected, the high severity and lack of verification make exploitation likely if the software is deployed in an untrusted environment."}}}}, "created": "2026-04-02T20:12:23.952270+00:00", "updated": "2026-04-02T20:21:04.535391+00:00", "vendors": ["krajowa_izba_rozliczeniowa", "krajowa_izba_rozliczeniowa$PRODUCT$szafirhost"]}