Loading story…
CERT Polska disclosed two vulnerabilities in Asseco proCertum SmartSign that can be triggered through crafted certificates and signature files. CVE-2026-57916 is a CWE-73 weakness caused by opening a Certificate Practice Statement URI without validating its schema, allowing an attacker to prepare a certificate that launches a local file or opens a remote URL when a victim opens a signed document. The issue reflects the broader risk of externally controlled file names or paths, which can lead to unauthorized file access, modification, or code execution.
CERT Polska also reported CVE-2026-57917, an XXE flaw (CWE-611) in SmartSign's handling of XML signatures. A crafted signature file can force the application to resolve external entities, enabling SSRF and, depending on parser settings, possible local file disclosure; the bug may be triggered even when a user only previews a file in the selection window before opening it. Both vulnerabilities affect versions prior to 9.4.3.90 and were fixed in 9.4.3.90; the issues were responsibly reported by Mariusz Maik.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-27, CERT Polska published two vulnerabilities in proCertum SmartSign: CVE-2026-57916, a CWE-73 issue involving unsafe URI schema handling, and CVE-2026-57917, an XXE flaw that can enable SSRF and possible local file reads.
CERT Polska reported that both vulnerabilities affected all proCertum SmartSign versions before 9.4.3.90 and were fixed in version 9.4.3.90.
CERT Polska said it coordinated disclosure of two vulnerabilities affecting Asseco proCertum SmartSign, and credited Mariusz Maik for responsibly reporting the issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecert.pl
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **CVE-2026-13165**, a high-severity remote code execution flaw in Krajowa Izba Rozliczeniowa's **SzafirHost** software that affects all versions before **1.2.2**. The vulnerability arises from inconsistent parsing of a downloaded signed native library archive: signature verification uses `JarFile` to read the ZIP Central Directory, while extraction uses `JarInputStream` to process local file headers sequentially. An attacker able to control the served archive can add a malicious **DLL**, **SO**, or **DYLIB** entry that does not appear in the Central Directory, allowing the archive to pass signature validation while the rogue library is still written to disk and potentially executed from the native temporary directory. The issue is tracked as **CVE-2026-13165**, carries a **CVSS 4.0 score of 8.6**, and was fixed in **SzafirHost 1.2.2** after coordinated disclosure by CERT Polska; **Mariusz Maik** was credited with reporting the flaw.
Jun 29, 2026
Trend Micro Apex Central 2019 **Build 6016 and earlier** contains two high-severity authenticated SQL injection vulnerabilities, **`CVE-2023-32529`** and **`CVE-2023-32530`**, that can be escalated to remote code execution. The flaws affect the `modTMMS` certificate-handling workflow, where user-controlled X.509 certificate fields are incorporated into SQLite queries without proper validation, including the `AddCert()` and `DeleteCertById()` paths. Researchers said even low-privilege authenticated users can exploit the bugs by uploading crafted certificate data through `proxy_controller.php`, using `module=modTMMS` and `tmms_cmd=set_certificates_config` to reach the vulnerable functionality. Because Apex Central uses SQLite on the backend, attackers can abuse the injection to write a malicious PHP file into the webroot and execute system commands as the **`IUSR`** account. Both issues carry a **CVSS v3.1 score of 8.8** and were patched by Trend Micro on **December 19, 2022**, before public disclosure by STAR Labs and ZDI. Defenders are advised to update Apex Central to the latest available version and inspect the widget repository directory for suspicious PHP files that could indicate compromise.
Jun 29, 2026
Adobe disclosed two high-severity reflected cross-site scripting vulnerabilities in **Adobe Connect**—`CVE-2026-27245` and `CVE-2026-27243`—affecting versions **2025.3, 12.10, and earlier**. The flaws allow an attacker to trigger execution of malicious JavaScript in a victim’s browser if the victim is persuaded to open a specially crafted URL pointing to a vulnerable page. Both issues are classified as **CWE-79** and carry the same **CVSS v3.1** vector, `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`, indicating network-reachable exploitation with no privileges required but user interaction needed. Adobe referenced the vulnerabilities in security bulletin **APSB26-37**, and the changed scope plus high confidentiality and integrity impact suggest successful exploitation could let attackers act within the victim’s browser session and compromise exposed application data or actions.
Jun 29, 2026