CVE-2026-106036
Deferred Deferred - Pending Action

Szafir HTTPS Certificate Validation Bypass

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: CERT.PL

Description
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-106036
EUVD
EUVD-2026-113121

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Krajowa Izba Rozliczeniowa Szafir 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
AI Quick Actions have not been generated yet.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart