# Płatnik Vulnerabilities: CVE-2026-110970, CVE-2026-110971, CVE-2026-110972 (HTTP reliance, weak password encoding, client-side authentication)

> CERT Polska disclosed three vulnerabilities in Płatnik, the contribution-payer software maintained by Zakład Ubezpieczeń Społecznych (ZUS): updates and support files are fetched over plain HTTP, passwords use a weak encoding that can be trivially decoded, and authentication is performed client-side and can be bypassed. NVD scores them CVSS 4.0 2.3 (LOW), 7.7 (HIGH) and 8.6 (HIGH). All versions before metric 242 in version 10.02.002 are affected; the fix is metric 242.

- **Published:** 2026-11-01T02:40:01Z
- **Last reviewed:** 2026-11-01T02:40:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4949
- **ID:** TL-2026-4949
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-110970, CVE-2026-110971, CVE-2026-110972

## Description

CERT Polska published an advisory on 2026-10-30 covering three vulnerabilities in Płatnik, software used by contribution payers to handle social insurance (ZUS) filings in Poland. The vendor is Zakład Ubezpieczeń Społecznych. All versions before metric 242 in version 10.02.002 are affected, and the advisory states the issues were fixed in metric 242 of version 10.02.002. NVD records for all three CVEs were published the same day and reference the CERT Polska advisory and the ZUS Płatnik program page.

CVE-2026-110970 (CWE-1428, Reliance on HTTP instead of HTTPS): the software downloads updates, libraries and support files over unencrypted HTTP. An attacker positioned on the network path between the client and the update source can mount a man-in-the-middle attack, intercept the transferred data and replace legitimate files with malicious ones. Because the downloaded content includes libraries and support files, tampering plausibly leads to code execution on the victim workstation; the advisory itself states only interception and replacement of files. NVD scores this CVSS 4.0 2.3 LOW (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N).

CVE-2026-110971 (CWE-261, Weak Encoding for Password): the software uses a weak password encoding algorithm, so anyone who obtains an encoded password can easily decode it. Credential material stored or handled by the application is effectively recoverable. NVD scores this CVSS 4.0 7.7 HIGH (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Reported by Wojciech Giełda.

CVE-2026-110972 (CWE-603, Use of Client-Side Authentication): Płatnik performs authentication on the client side. An attacker with access to any application instance can bypass the login verification and impersonate arbitrary users. NVD scores this CVSS 4.0 8.6 HIGH (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N). Also reported by Wojciech Giełda.

The advisory itself provides no exploitation status, no proof-of-concept and no indicators of compromise; update-server hostnames and the weak encoding algorithm are not disclosed. No evidence of in-the-wild exploitation or CISA KEV listing was found. Severity is set to the highest NVD score (8.6, CVE-2026-110972). Defenders should update Płatnik to metric 242 or later of version 10.02.002, restrict local access to Płatnik hosts, and monitor for plain-HTTP update traffic from Płatnik workstations until patched.

## MITRE ATT&CK

- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1552 Unsecured Credentials
- T1195.002 Compromise Software Supply Chain
- T1565.002 Transmitted Data Manipulation
- T1078 Valid Accounts

## Sources

- [Vulnerabilities in Płatnik software - CERT Polska](https://cert.pl/en/posts/2026/10/CVE-2026-110970/)
- [NVD - CVE-2026-110970](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110970)
- [NVD - CVE-2026-110971](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110971)
- [NVD - CVE-2026-110972](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110972)
- [ZUS - Program Płatnik (vendor page)](https://www.zus.pl/firmy/program-platnik/o-programie-platnik)
- [CERT Polska Coordinated Vulnerability Disclosure Policy](https://cert.pl/en/cvd/)
- [CWE-1428: Reliance on HTTP instead of HTTPS](https://cwe.mitre.org/data/definitions/1428.html)
- [CWE-261: Weak Encoding for Password](https://cwe.mitre.org/data/definitions/261.html)
- [CWE-603: Use of Client-Side Authentication](https://cwe.mitre.org/data/definitions/603.html)
- [New version of the Płatnik program made available by ZUS - Poczta Polska](https://www.poczta-polska.pl/en/news/nowa-wersja-programu-platnik-udostepniona-przez-zus/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4949