Critical RCE vulnerability in Disig Web Signer
Priority MEDIUM 50CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0072 54th percentileScored 2026-11-07
Fix Fixed Web Signer (Disig): 2.5.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Web Signer (Disig) Fixed in 2.5.5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8931
- 2026-10-03 Alias added: GHSA-vcv9-hx6w-934w
References
Other 6
- https://www.disig.sk/en/news/important-update-of-the-web-signer-application/
- https://www.disig.sk/sk/aktuality/dolezita-aktualizacia-aplikacie-web-signer/
- https://download.disigcdn.sk/cdn/products/websigner2/changelog.en.txt
- https://download.disigcdn.sk/cdn/products/websigner2/changelog.sk.txt
- https://qesportal.sk/Portal/en/Info/News#websigner255
- https://qesportal.sk/Portal/sk/Info/News#websigner255
Sources
- CVE-2026-8931 · CVE Program
- CVE-2026-8931 · NVD
- FIRST EPSS
- GHSA-vcv9-hx6w-934w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences