Which versions of R-SOFT DMS are affected by CVE-2026-41879?

R-SOFT DMS contains a critical credential disclosure vulnerability (CVE-2026-41879, CVSS 8.2) enabling attackers who gain access to system storage to recover the superadmin password through trivial…

How to fix or mitigate CVE-2026-41879?

Within 24 hours: Audit all R-SOFT DMS deployments and document superadmin account usage patterns; implement network segmentation to restrict access to the DMS to authorized personnel only. Within 7 days: review system and database access logs for unauthorized attempts to read configuration files or password hashes; enable enhanced logging on the superadmin account. Within 30 days: establish a vendor communication protocol to track patch availability; prepare a change management plan for immediate deployment when a fix is released, including procedures for superadmin password rotation at that time.

R-SOFT DMS CVE-2026-41879

Q: What is the CVSS score of CVE-2026-41879?

CVE-2026-41879 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42857 HIGH

Use of Weak Hash (CWE-328)

2026-07-10 cvd@cert.pl

GHSA-2mx5-42xw-7586

Information Disclosure

8.2

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

AC:H because exploitation depends on first obtaining the hash (a precondition outside attacker control); confidentiality-only (C:H, I:N, A:N) as the flaw discloses superadmin credentials.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 10:36 vuln.today

DescriptionCVE.org

R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file.

This issue was fixed in version v3.17-2000.

AnalysisAI

Credential disclosure in R-SOFT DMS lets an attacker who obtains the stored superadmin password hash recover the plaintext password, because credentials are protected with a non-salted, nested MD5 hash that is trivially reversible via brute-force and precomputed rainbow tables. The superadmin account is high-value and cannot be rotated through the UI - the password can only be changed by editing the configuration file - so recovered credentials remain valid indefinitely. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-328 (Use of Weak Hash). Instead of a modern, salted, computationally-hard password KDF (bcrypt, scrypt, Argon2, or at minimum PBKDF2), R-SOFT DMS - a document management system - stores the superadmin credential as a nested MD5 digest (MD5 applied more than once) with no per-user salt. MD5 is fast and broken for password storage; the absence of salt means identical passwords produce identical hashes and precomputed rainbow tables apply directly, while nesting adds negligible work factor. This turns any exposure of the stored hash (config file, database, backup, or memory) into a full plaintext-credential compromise. The reporter (CERT Polska, cert.pl) classifies the issue as Information Disclosure.

RemediationAI

Vendor-released patch: v3.17-2000 - upgrade R-SOFT DMS to v3.17-2000 or later, which addresses the weak-hash storage. Because the superadmin password cannot be changed except by editing the configuration file, after upgrading you must also rotate the superadmin credential (set a new strong password via the config file) so that any previously exposed hash becomes useless; simply patching does not invalidate an already-leaked credential. As compensating controls where immediate patching is not possible: tightly restrict filesystem/OS access to the configuration file and any database or backups that contain the hash (least-privilege, remove world/group read), monitor for unauthorized reads of the config file, and place the DMS admin interface behind network segmentation or a VPN to limit who can reach and reuse recovered credentials - the trade-off is added operational friction for administrators. Consult the CERT Polska advisory (https://cert.pl/posts/2026/07/CVE-2026-41876) for authoritative details, verifying the correct CVE reference.