[ CVE-2026-106036 · Published 29 Oct 2026 ]
Vulnerability in Krajowa Izba Rozliczeniowa Szafir
CVSS 6.9
EPSS <1%No fix listed yet
[ Description ]Official description
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.