High

Hard-coded credentials in KS-SOMED update mechanism

IdentifiersCVE-2026-42251CWE-798· Use of Hard-coded Credentials

CVE-2026-42251 is a use-of-hard-coded-credentials vulnerability in KAMSOFT KS-SOMED. Hard-coded credentials embedded in the KS-SOMED update-related modules KSPLUPDFTP.exe up to version 30.00.00.056 and ANEKSKLIENT.EXE up to version 29.00.02.026 allowed unauthorized access to the FTP server hosting the application's update packages. An attacker who obtained or extracted those credentials could authenticate to that server and upload a malicious update file, which could then be distributed and installed on client systems as though it were a legitimate vendor update.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could enable a supply-chain style compromise of KS-SOMED clients. By using the exposed FTP credentials to place a malicious update package on the update server, an attacker could cause downstream client machines to receive and potentially install attacker-controlled code under the guise of a legitimate software update. This creates risk of widespread unauthorized code execution on client endpoints, compromise of confidentiality and integrity of affected environments, and broad downstream operational impact.

Mitigation

If you can’t patch tonight, do this now.

If immediate remediation is not possible, restrict the exposed FTP account to read-only or disable it entirely, rotate credentials, and tightly limit network access to the update server. Monitor the update repository and server logs for unauthorized authentication or file changes, verify update package integrity before distribution, and review clients for unexpected or untrusted updates. Additional compensating controls should focus on hardening the update pipeline and preventing unsigned or unverified packages from being accepted.

Remediation

Patch, then assume compromise.

Apply vendor-provided fixes for KS-SOMED that remove the hard-coded credentials and implement the changed update process. Upgrade affected modules beyond KSPLUPDFTP.exe 30.00.00.056 and ANEKSKLIENT.EXE 29.00.02.026. Rotate or revoke any credentials that were embedded or otherwise exposed, and ensure previously exposed access is no longer usable for write operations. Validate the integrity of update infrastructure and review update packages for unauthorized modification.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cert polskaNews

Jun 1, 2026

Vulnerability in KS-SOMED software | CERT Polska

A use of hard-coded credentials vulnerability in KAMSOFT KS-SOMED that could allow unauthorized access to the FTP server hosting application update packages, potentially enabling malicious updates to be uploaded and distributed as legitimate updates.

cvefeed high severityNews

Jun 1, 2026

CVE-2026-42251 - Hard-coded credentials in KS-SOMED

A hard-coded credentials vulnerability in KS-SOMED that could allow unauthorized access to the FTP server hosting application update packages, enabling upload of malicious updates that may be distributed to client machines as legitimate updates.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3