How to fix or mitigate CVE-2026-26928?

Within 24 hours: Identify all systems running SzafirHost and document current versions via inventory or EDR telemetry. Within 7 days: Distribute upgrade notice to users and deploy SzafirHost version 1.1.0 or later via software distribution or direct user communication; verify installation completion. Within 30 days: Audit logs for suspicious native library downloads to /temp during the vulnerable period; validate signature logs for any anomalies coinciding with exposure window.

CVE-2026-26928

Q: What is the CVSS score of CVE-2026-26928?

CVE-2026-26928 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18229 HIGH

Improper Validation of Integrity Check Value (CWE-354)

2026-04-02 cvd@cert.pl

Information Disclosure

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.1.0

EUVD ID Assigned

Apr 02, 2026 - 14:22 euvd

EUVD-2026-18229

Analysis Generated

Apr 02, 2026 - 14:22 vuln.today

CVE Published

Apr 02, 2026 - 14:16 nvd

HIGH 8.7

DescriptionCVE.org

SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application.

This issue was fixed in version 1.1.0.

AnalysisAI

Cryptographic verification bypass in SzafirHost (e-signature client software) allows remote attackers to deliver and execute malicious native libraries (DLL/SO/JNILIB/DYLIB) without authentication. While JAR files are hash- and signature-verified during auto-update, native libraries downloaded into the user's /temp folder skip all integrity checks, enabling code execution in the context of the web page initiating the download. Fixed in version 1.1.0. No public exploit identified at time of analysis, though attack complexity is low (CVSS AC:L) and requires no user interaction (UI:N), suggesting straightforward exploitation against users running vulnerable versions.

Technical ContextAI

SzafirHost is a client-side helper application for elektronicznypodpis.pl digital signature services, enabling browser-based cryptographic operations by downloading and executing platform-specific native libraries. The application implements asymmetric trust validation: JAR files undergo both SHA hash whitelist checks and digital signature verification against the vendor's certificate, but native code files (Windows DLL, Linux SO, macOS JNILIB/DYLIB) bypass these controls entirely. This represents CWE-354 (Improper Validation of Integrity Check Value) - the application fails to perform cryptographic verification on critical executable components. The auto-update mechanism executes in the security context of the initiating web page, meaning a compromised or malicious site could trigger downloads of attacker-controlled libraries that execute with the privileges of the SzafirHost process.

RemediationAI

Upgrade SzafirHost to version 1.1.0 or later, which implements cryptographic hash validation and digital signature verification for native library files matching the existing JAR file controls. Users should download the patched version directly from the official vendor portal at https://www.elektronicznypodpis.pl/. System administrators deploying SzafirHost in enterprise environments should audit installed versions and push the 1.1.0 update via software management tools. No workarounds are effective - the vulnerability is architectural and requires the code fix. Until patching is complete, organizations should restrict SzafirHost usage to trusted websites and consider network-level controls to limit exposure. Detailed remediation guidance is available in CERT Polska's advisory at https://cert.pl/posts/2026/04/CVE-2026-26927.