Loading story…
CERT Polska disclosed CVE-2026-42251, a hard-coded credentials flaw in KAMSOFT KS-SOMED that exposed the FTP server used to host application update packages. The vulnerability affects KSPLUPDFTP.exe through version 30.00.00.056 and ANEKSKLIENT.EXE through version 29.00.02.026. An attacker who obtained the embedded credentials could gain unauthorized access to the update server and upload a malicious package that could later be delivered to client systems as if it were a legitimate software update.
KAMSOFT said it mitigated the issue by removing the hard-coded credentials, changing the update process, and restricting the previously exposed credentials to read-only access. The flaw is tracked as CWE-798 and highlights a software supply-chain risk for organizations running KS-SOMED, because compromise of the update distribution path could enable downstream installation of attacker-controlled code on customer machines.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed CVE-2026-42251, describing how hard-coded credentials in KS-SOMED could let an attacker upload a malicious update package that might be distributed to client machines as legitimate software. The disclosure identified affected modules and versions in KAMSOFT's software.
The vulnerability record states that CVE-2026-40543, a missing authorization flaw in SOPlanning, was received by cvd@cert.pl. The issue exposed backup-related endpoints to unauthenticated attackers and could allow retrieval of backup archives containing user databases and sensitive configuration data.
KAMSOFT mitigated CVE-2026-42251 by removing the hard-coded credentials, changing the update process, and restricting the previously exposed credentials to read-only access. The flaw affected KSPLUPDFTP.exe through version 30.00.00.056 and ANEKSKLIENT.EXE through version 29.00.02.026.
The vulnerability record states that CVE-2026-42251, a hard-coded credentials flaw in KS-SOMED, was received by cvd@cert.pl. The issue could allow unauthorized access to the FTP server hosting update packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecert.pl
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
CERT Polska disclosed **CVE-2026-17038**, a hard-coded credentials vulnerability affecting drEryk Gabinet software. Embedded credentials can enable unauthorized access where attackers obtain or can derive the affected credentials. The published notice does not identify affected versions, assign a severity score, provide exploitation evidence, or include remediation guidance. Organizations using drEryk Gabinet should identify deployed instances, monitor CERT Polska and the vendor for technical updates and patches, and review access controls and authentication logs for suspicious activity.
Sep 11, 2026
Sophos disclosed and remediated three high-severity local privilege escalation vulnerabilities in **Sophos Endpoint and Workload Protection for Windows**, **Sophos Central Device Encryption**, and the Windows installer, tracked as `CVE-2024-13972`, `CVE-2025-7433`, and `CVE-2025-7472`. The flaws could allow a local user to gain **SYSTEM** privileges, and `CVE-2025-7433` could also enable arbitrary code execution. Sophos said customers using the default **Recommended** update policy generally received fixes automatically, while organizations on **FTS**, **LTS**, or using older installer packages must upgrade manually and, for installer-related exposure, download a fresh installer from Sophos Central. Details published on `CVE-2025-7433` describe a **CWE-502 deserialization of untrusted data** issue in the encryption service of Sophos Intercept X for Windows with Central Device Encryption, affecting versions prior to **2025.1** and allowing crafted serialized payloads to run code as **SYSTEM** during configuration, policy, or inter-process message handling. Sophos said fixes are available in **FTS 2024.3.2** and later and **LTS 2024.1.1.50** and later. The disclosure follows an earlier Device Encryption privilege-escalation bug, `CVE-2024-8885`, which allowed arbitrary file writing in version **2024.2.0** and older and was fixed in **2024.2.1.6**; Sophos credited external researchers including **Filip Dragovic** of MDSec, **Sina Kheirkhah** of watchTowr, and **Sandro Poppi** via its bug bounty program.
Jun 29, 2026