CVE-2026-26928 Lack of Dynamic Library Validation in SzafirHost
Attackers can execute arbitrary code by providing malicious dynamic libraries that bypass signature verification in SzafirHost.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26928?
CVE-2026-26928 is a high-severity code injection vulnerability in Krajowa Izba Rozliczeniowa SzafirHost, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application.
This issue was fixed in version 1.1.0.
Weakness: CWE-354
Which versions are affected by CVE-2026-26928?
How do I fix CVE-2026-26928?
No fix has been published for CVE-2026-26928 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-26928 being exploited?
There is no known exploitation of CVE-2026-26928 in the wild and no public exploit code.
Sources
Also known as GHSA-cg6j-gw4m-cw76.