Remote Code Execution in SzafirHost
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded. This issue was fixed in version 1.2.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Krajowa Izba Rozliczeniowa | SzafirHost | before 1.2.1 | 1.2.1 | Patch available | CNA |
- SzafirHost VendorKrajowa Izba Rozliczeniowa Affected before 1.2.1 Fixed in 1.2.1 Patch available CNA
Remediation
- Fix · CNA SzafirHost (Krajowa Izba Rozliczeniowa) Fixed in 1.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44088
- 2026-10-03 Alias added: GHSA-j8f8-frc5-vgc6
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More Krajowa Izba Rozliczeniowa vulnerabilities
- TI-2026-07960 Improper Certificate Verification in Szafir SDK CVSS 4.0CRITICAL 9.3
- TI-2026-21415 Lack of Dynamic Library Validation in SzafirHost CVSS 4.0HIGH 8.7
- TI-2026-11178 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
- TI-2026-82552 Szafir accepts unvalidated TLS certificates for update downloads CVSS 4.0MEDIUM 6.9
- TI-2026-82528 XML external entity injection in Szafir and Szafir Weryfikująca CVSS 4.0HIGH 8.2
- TI-2026-21414 URL (HTTP Origin) call location spoofing in Szafir SDK Web CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-44088 · CVE Program
- CVE-2026-44088 · NVD
- FIRST EPSS
- GHSA-j8f8-frc5-vgc6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences