Cyber Resilience

CVE-2026-26928

High

Published: 02 April 2026

Published
02 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0021 11.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-26928 is a high-severity Improper Validation of Integrity Check Value (CWE-354) vulnerability in Cert (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 11.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that…

more

list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application. This issue was fixed in version 1.1.0.

CWE(s)
CWE-354

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
attack.mitre.org →
Why these techniques?

Vuln allows web-triggered download+execution of unverified malicious native libs (DLL/SO/etc.), directly enabling drive-by compromise via malicious file.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

Cert
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-18 Tamper Resistance and Detection
addresses: CWE-354

Proper validation of integrity check values is required for reliable tamper detection, directly reducing undetected modification risks.

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
addresses: CWE-354

Requires validation of integrity check values on every resolution response, directly mitigating tampered or corrupted DNS data.

SC-33 Transmission Preparation Integrity
addresses: CWE-354

Control mandates proper validation of integrity values (checksums) on prepared data, making flawed validation of those checks ineffective for attackers.

SI-7 Software, Firmware, and Information Integrity
addresses: CWE-354

Requires use of proper integrity verification tools, reducing the chance an incorrect check value is accepted.

SR-9 Tamper Resistance and Detection
addresses: CWE-354

Requires proper validation of integrity mechanisms, directly mitigating flawed check-value handling.

References