Threat reportVulnerabilityTL-2026-4949
Płatnik Vulnerabilities: CVE-2026-110970, CVE-2026-110971, CVE-2026-110972 (HTTP reliance, weak password encoding, client-side authentication)
Płatnik Vulnerabilities (TL-2026-4949) is a high-severity software vulnerability scored CVSS 8.6, first published 2026-11-01. It has no confirmed attribution, affects Zakład Ubezpieczeń Społecznych (ZUS) Płatnik, references 3 CVEs (CVE-2026-110970, CVE-2026-110971, CVE-2026-110972), maps to 6 MITRE ATT&CK techniques (T1040, T1078, T1195.002), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 8.6/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4949
- Threat ID
- TL-2026-4949
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, business-services
- Target regions
- poland
- Detection rules
- 9
- Indicators of compromise
- 6
How Płatnik Vulnerabilities works
CERT Polska disclosed three vulnerabilities in Płatnik, the contribution-payer software maintained by Zakład Ubezpieczeń Społecznych (ZUS): updates and support files are fetched over plain HTTP, passwords use a weak encoding that can be trivially decoded, and authentication is performed client-side and can be bypassed. NVD scores them CVSS 4.0 2.3 (LOW), 7.7 (HIGH) and 8.6 (HIGH). All versions before metric 242 in version 10.02.002 are affected; the fix is metric 242.
CERT Polska published an advisory on 2026-10-30 covering three vulnerabilities in Płatnik, software used by contribution payers to handle social insurance (ZUS) filings in Poland. The vendor is Zakład Ubezpieczeń Społecznych. All versions before metric 242 in version 10.02.002 are affected, and the advisory states the issues were fixed in metric 242 of version 10.02.002. NVD records for all three CVEs were published the same day and reference the CERT Polska advisory and the ZUS Płatnik program page.
CVE-2026-110970 (CWE-1428, Reliance on HTTP instead of HTTPS): the software downloads updates, libraries and support files over unencrypted HTTP. An attacker positioned on the network path between the client and the update source can mount a man-in-the-middle attack, intercept the transferred data and replace legitimate files with malicious ones. Because the downloaded content includes libraries and support files, tampering plausibly leads to code execution on the victim workstation; the advisory itself states only interception and replacement of files. NVD scores this CVSS 4.0 2.3 LOW (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N).
CVE-2026-110971 (CWE-261, Weak Encoding for Password): the software uses a weak password encoding algorithm, so anyone who obtains an encoded password can easily decode it. Credential material stored or handled by the application is effectively recoverable. NVD scores this CVSS 4.0 7.7 HIGH (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Reported by Wojciech Giełda.
CVE-2026-110972 (CWE-603, Use of Client-Side Authentication): Płatnik performs authentication on the client side. An attacker with access to any application instance can bypass the login verification and impersonate arbitrary users. NVD scores this CVSS 4.0 8.6 HIGH (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N). Also reported by Wojciech Giełda.
The advisory itself provides no exploitation status, no proof-of-concept and no indicators of compromise; update-server hostnames and the weak encoding algorithm are not disclosed. No evidence of in-the-wild exploitation or CISA KEV listing was found. Severity is set to the highest NVD score (8.6, CVE-2026-110972). Defenders should update Płatnik to metric 242 or later of version 10.02.002, restrict local access to Płatnik hosts, and monitor for plain-HTTP update traffic from Płatnik workstations until patched.
MITRE ATT&CK techniques used in TL-2026-4949
Credential Access
T1040 Network Sniffing; T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle
Defense Evasion
Initial Access
T1195.002 Compromise Software Supply Chain
Impact
Affected products and versions in Płatnik Vulnerabilities
- Zakład Ubezpieczeń Społecznych (ZUS) — Płatnik
Vulnerable versions: All versions before metric 242 in version 10.02.002
Fixed in: Metric 242 in version 10.02.002
Remediation for Płatnik Vulnerabilities
Patches
- Metric 242 in version 10.02.002 (vendor: Zakład Ubezpieczeń Społecznych)
Immediate actions
- Update Płatnik to metric 242 or later of version 10.02.002
- Restrict or monitor outbound plain-HTTP traffic from workstations running Płatnik until patched
Workarounds
- Run Płatnik update checks only from trusted, segmented networks to reduce man-in-the-middle exposure
- Limit local access to Płatnik hosts to authorized users
Longer-term hardening
- Enforce HTTPS/TLS-only update channels for line-of-business software where configurable
- Treat credentials handled by affected Płatnik versions as recoverable and rotate them after patching
CVEs associated with Płatnik Vulnerabilities
Weaknesses (CWE) in Płatnik Vulnerabilities
Timeline of Płatnik Vulnerabilities
- The advisory reports no exploitation, no proof-of-concept and no indicators of compromise for any of the three issues.
- Wojciech Giełda was credited for responsibly disclosing CVE-2026-110971 and CVE-2026-110972.
- Advisory states the fix is metric 242 in version 10.02.002; all earlier versions are affected. The fix release date is not stated in the source.
- NVD records for all three CVEs were published with CVSS 4.0 scores of 2.3 LOW (CVE-2026-110970), 7.7 HIGH (CVE-2026-110971) and 8.6 HIGH (CVE-2026-110972), referencing the CERT Polska advisory and the ZUS Płatnik page.
- CVE-2026-110970 (CWE-1428), CVE-2026-110971 (CWE-261) and CVE-2026-110972 (CWE-603) were published via CERT Polska as the reporting source.
- CERT Polska published the advisory 'Vulnerabilities in Płatnik software' covering three vulnerabilities.
- Threadlinqs researched the advisory and cross-checked NVD scoring; no in-the-wild exploitation, public PoC or CISA KEV listing was found.
Sources cited for Płatnik Vulnerabilities
- Vulnerabilities in Płatnik software - CERT Polska
- NVD - CVE-2026-110970
- NVD - CVE-2026-110971
- NVD - CVE-2026-110972
- ZUS - Program Płatnik (vendor page)
- CERT Polska Coordinated Vulnerability Disclosure Policy
- CWE-1428: Reliance on HTTP instead of HTTPS
- CWE-261: Weak Encoding for Password
- CWE-603: Use of Client-Side Authentication
- New version of the Płatnik program made available by ZUS - Poczta Polska
Detection coverage for TL-2026-4949
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4949 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.