Which versions of eParakstītājs 3.0 are affected by CVE-2026-0392?

eParakstītājs 3.0 for Windows versions before 1.10.0 contain a critical vulnerability that compromises the integrity of the automatic update system, allowing complete system takeover through a…. A patch is available.

How to fix or mitigate CVE-2026-0392?

Within 24 hours, inventory all systems running eParakstītājs versions before 1.10.0 and assess network exposure to man-in-the-middle attack vectors, particularly on untrusted or external networks; validate through endpoint monitoring that no suspicious update activity has occurred. Within 7 days, execute a planned upgrade to eParakstītājs version 1.10.0 or later, prioritizing systems in high-risk network environments; coordinate with affected business units to minimize operational disruption. Within 30 days, complete the upgrade across all systems, document remediation, and implement enhanced monitoring for anomalous update behavior or system compromise indicators.

eParakstītājs 3.0 CVE-2026-0392

Q: What is the CVSS score of CVE-2026-0392?

CVE-2026-0392 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-52259 HIGH

Download of Code Without Integrity Check (CWE-494)

2026-08-03 ENISA

GHSA-gw22-gf8m-29g5

RCE Microsoft Eparakst T Js 3 0

7.3

CVSS 4.0 · Vendor: ENISA

Severity by source

Vendor (ENISA) PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

AV:A and AC:H reflect the mandatory MITM network position; UI:R captures the required application launch; S:U because execution stays within the victim user context.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ENISA).

CVSS VectorVendor: ENISA

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 03, 2026 - 11:02 EUVD

Analysis Generated

Aug 03, 2026 - 10:31 vuln.today

CVE Published

Aug 03, 2026 - 09:56 cve.org

HIGH 7.3

DescriptionCVE.org

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.

AnalysisAI

Insecure automatic update delivery in eParakstītājs 3.0 for Windows (versions before 1.10.0) enables a man-in-the-middle attacker to deliver and execute arbitrary code on a victim's machine without any integrity verification. The application fetches update metadata over TLS but accepts any TLS certificate via a permissive TrustManager and a HostnameVerifier that always returns true, then downloads and executes an installer with no digital signature, Authenticode, or checksum validation. No public exploit has been identified at time of analysis, though the vulnerability class (CWE-494) is reliably exploitable once MITM positioning is achieved.

Technical ContextAI

eParakstītājs 3.0 is a Latvian electronic signature application produced by Latvijas Valsts radio un televīzijas centrs (LVRTC), identified by CPE cpe:2.3:a:latvijas_valsts_radio_un_televīzijas_centrs_(lvrtc):eparakstītājs_3.0. The root cause is CWE-494 (Download of Code Without Integrity Check). The auto-update pipeline fetches an XML update descriptor from www.eparaksts.lv using a custom TLS client that accepts any certificate (broken TrustManager) and ignores hostname mismatches (HostnameVerifier always returns true), effectively nullifying transport-layer security. Neither the XML descriptor nor the downloaded installer binary is verified via digital signature, Authenticode, or checksum before execution. This eliminates every layer of supply-chain trust that a proper update mechanism would require: channel authentication (TLS cert validation), descriptor integrity (signature), and payload integrity (Authenticode or hash).

RemediationAI

Upgrade to eParakstītājs 3.0 version 1.10.0 or later, as documented in the vendor advisory at https://www.eparaksts.lv/lv/par_mums/Jaunumi/Jauna_eParakstitajs_30_versija_1100; this release addresses the broken TLS validation and missing integrity checks in the update pipeline. Until the patch is deployed, users should avoid launching the application on untrusted or shared network segments - public Wi-Fi, hotel networks, and shared corporate Wi-Fi without 802.1X - to deny the attacker the required MITM position; this does not fix the underlying flaw but eliminates the realistic attack surface for most users. Network administrators can block outbound HTTPS from eParakstītājs hosts to www.eparaksts.lv at the perimeter firewall, which eliminates the attack vector entirely but also prevents receipt of legitimate updates, requiring manual patch distribution as a side effect. DNS monitoring for anomalous resolution of www.eparaksts.lv provides a detection capability for DNS-poisoning-based attack attempts.