Loading story…
CERT Polska disclosed CVE-2026-17038, a hard-coded credentials vulnerability affecting drEryk Gabinet software. Embedded credentials can enable unauthorized access where attackers obtain or can derive the affected credentials.
The published notice does not identify affected versions, assign a severity score, provide exploitation evidence, or include remediation guidance. Organizations using drEryk Gabinet should identify deployed instances, monitor CERT Polska and the vendor for technical updates and patches, and review access controls and authentication logs for suspicious activity.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska published a vulnerability warning concerning drEryk Gabinet software. A related reference identifies the issue as CVE-2026-17038, involving use of hard-coded credentials; affected versions, exploitation status, and remediation details were not provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rich Source **DMS+ (Non-Mobile)** contains a critical hard-coded credentials flaw tracked as **`CVE-2026-18452`** that allows **unauthenticated remote attackers** to use a fixed embedded API key to gain administrative control over affected DMS+ instances and the devices they manage. The vulnerability affects **versions 5.63 and earlier** and is classified as **CWE-798: Use of Hard-coded Credentials**. The issue carries a **CVSS v3.1 score of 9.8** with impact to confidentiality, integrity, and availability, and public reporting said exploitation requires no authentication and low attack complexity. **Rich Source** addressed the flaw in **version 5.64**, while **TWCERT/CC** published an advisory; no active exploitation had been reported at the time of publication.
Jul 31, 2026
CERT Polska disclosed **CVE-2026-41874** in OpenSolution Quick.Cart, a flaw that stores hard-coded administrator credentials in plaintext within a configuration file. The issue is classified as **`CWE-256` Plaintext Storage of a Password** and affects Quick.Cart through version **6.7**; although only version 6.7 was explicitly tested, all versions are considered vulnerable. An attacker with access to the server file system could recover the embedded credentials and use them to escalate privileges within the application. CERT Polska said it received the report and coordinated disclosure, while the vendor assessed the likelihood of exploitation as very low and decided not to issue a fix.
Jul 28, 2026
CERT Polska disclosed **CVE-2026-42251**, a hard-coded credentials flaw in KAMSOFT **KS-SOMED** that exposed the FTP server used to host application update packages. The vulnerability affects `KSPLUPDFTP.exe` through version `30.00.00.056` and `ANEKSKLIENT.EXE` through version `29.00.02.026`. An attacker who obtained the embedded credentials could gain unauthorized access to the update server and upload a malicious package that could later be delivered to client systems as if it were a legitimate software update. KAMSOFT said it mitigated the issue by removing the hard-coded credentials, changing the update process, and restricting the previously exposed credentials to **read-only** access. The flaw is tracked as **CWE-798** and highlights a software supply-chain risk for organizations running KS-SOMED, because compromise of the update distribution path could enable downstream installation of attacker-controlled code on customer machines.
Jun 29, 2026