CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library

Key facts for KAMSOFT ZSIRep certificate flaw

Detection coverage for KAMSOFT ZSIRep certificate flaw

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5422 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vulnerable KAMSOFT ZSIRep CLIENT Library Loaded (CVE-2026-113618) [Splunk SPL]

Identifies hosts where ZSIREP.CLIENT.DLL is loaded and (SPL) compares FileVersion against the fixed 2.12.3.1. Affected builds register a process-wide .NET certificate-validation callback that accepts any TLS certificate (CWE-295), so these hosts are exposed to adversary-in-the-middle interception and modification of authentication data and documents. Exposure finding, not evidence of exploitation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1557, T1040, T1565.002
• Data sources: sysmon, windows_defender_atp
• Severity: medium
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 ImageLoaded="*\\ZSIREP.CLIENT.DLL" earliest=-24h
| eval ver=split(FileVersion,".")
| eval v1=tonumber(mvindex(ver,0)), v2=tonumber(mvindex(ver,1)), v3=tonumber(mvindex(ver,2)), v4=tonumber(mvindex(ver,3))
| eval vulnerable=case(isnull(v1),1, v1<2,1, v1==2 AND v2<12,1, v1==2 AND v2==12 AND v3<3,1, v1==2 AND v2==12 AND v3==3 AND v4<1,1, true(),0)
| where vulnerable=1
| stats count min(_time) as first_seen max(_time) as last_seen values(FileVersion) as file_version values(Image) as host_process by host, ImageLoaded

Microsoft KQL

// CVE-2026-113618: hosts loading ZSIREP.CLIENT.DLL. Compare SHA256 / product version against the fixed 2.12.3.1 build.
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "ZSIREP.CLIENT.DLL"
| project Timestamp, DeviceName, DeviceId, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessFolderPath
| summarize LoadCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Processes=make_set(InitiatingProcessFileName) by DeviceName, FolderPath, SHA256

Sigma

title: KAMSOFT ZSIRep CLIENT Library Loaded (CVE-2026-113618 Exposure)
id: 6f1c2a4e-5b7d-4c3a-9e10-3a5d8b2f1c01
status: experimental
description: Detects a process loading ZSIREP.CLIENT.DLL. Versions before 2.12.3.1 register a process-wide .NET certificate validation callback that accepts any certificate (CWE-295), enabling adversary-in-the-middle interception. Use for exposure inventory and verify the file version.
references:
  - https://cert.pl/en/posts/2026/11/CVE-2026-113618/
  - https://attack.mitre.org/techniques/T1557/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.credential-access
  - attack.collection
  - attack.impact
  - attack.t1557
  - attack.t1040
  - attack.t1565.002
  - cve.2026.113618
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '\ZSIREP.CLIENT.DLL'
  condition: selection
falsepositives:
  - Patched ZSIRep CLIENT 2.12.3.1 or later (Sigma cannot compare file versions; filter by hash or version downstream)
  - Legitimate KAMSOFT KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB and KS-ASW operation
level: medium

Known false positives:

• Hosts already upgraded to ZSIRep CLIENT 2.12.3.1 or later (KQL and Sigma do not compare versions)
• Authorised KAMSOFT product usage during the patch window

Tuning notes: Keep a hash or version allow-list of fixed ZSIREP.CLIENT.DLL builds. Requires Sysmon Event ID 7 (ImageLoad) enabled for the KAMSOFT install paths. Treat hits as exposure findings, not evidence of exploitation; prioritise hosts on shared or untrusted network segments.

• 🔒 Unpatched KAMSOFT Products Installed: [indicator], [indicator], [indicator], [indicator], [indicator], ZSIRep (CVE-2026-113618) [Sentinel KQL] · unlock with TL Creds
• 🔒 Root Certificate Store Tampering on Hosts (Trusted Interception Prep) [Sentinel KQL] · unlock with TL Creds
• 🔒 Proxy or PAC Redirection Configured on [indicator] Hosts (Traffic Redirection) [Sentinel KQL] · unlock with TL Creds
• 🔒 Linux AiTM Toolkit Execution: bettercap, ettercap, arpspoof, mitmproxy, Responder [Sigma] · unlock with TL Creds
• 🔒 Inveigh and LLMNR/NBT-NS/mDNS Poisoning Frameworks in PowerShell Script Blocks [Sigma] · unlock with TL Creds
• 🔒 Windows Built-in Packet Capture: netsh trace, pktmon, Npcap/WinPcap Service Install [Sigma] · unlock with TL Creds
• 🔒 AiTM and Packet Capture Tool Execution on Windows Endpoints (CVE-2026-113618 context) [Splunk SPL] · unlock with TL Creds
• 🔒 [indicator] Process Connecting to New HTTPS Destination (Possible Server Impersonation) [Splunk SPL] · unlock with TL Creds

Indicators of compromise for KAMSOFT ZSIRep certificate flaw

As of 2026-11-06, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5422.

How KAMSOFT ZSIRep certificate flaw works

CVE-2026-113618 is an improper certificate validation weakness (CWE-295) in the KAMSOFT ZSIRep CLIENT library, disclosed by CERT Polska on 2026-11-06. According to the advisory, the library does not validate the server certificate of the HTTPS endpoints it connects to. Instead it registers a process-wide .NET certificate-validation callback that accepts any certificate without verification.

Because TLS server authentication is effectively disabled, an attacker who can position themselves between the client and the server (adversary-in-the-middle) can present an arbitrary certificate and transparently intercept the traffic. The advisory states this exposes authentication data and documents exchanged by the client. The advisory also notes that the callback persists after the client is closed, so other HTTPS connections made within the same application process may also lose certificate validation.

Affected: all ZSIRep CLIENT library versions before 2.12.3.1, and the dependent KAMSOFT products KS-SOMED (before 2026.03.0.01), KS-PPS (before 2026.03.1.0), KS-MEDIS (before 2026.03.0.0), KS-SOLAB (before 2026.3.1.0) and KS-ASW (before 2026.3.0.1). The reporter is credited as Kajetan Pawelec.

Evidence limits: the source publishes no CVSS score, no exploitation status, no proof of concept, no timeline and no mitigation guidance beyond the fixed versions. No indicators of compromise are published; the IOC entries below are affected-component and behavioral indicators for exposure assessment, not evidence of active exploitation. The NVD API returned no record for this CVE at research time. Severity MEDIUM is an analyst-assigned placeholder pending official scoring (exploitation requires a man-in-the-middle network position, but the data exposed includes authentication material and documents); cvss_score is intentionally null.

MITRE ATT&CK techniques by tactic:

Credential Access

T1040 Network Sniffing; T1557 Adversary-in-the-Middle

Discovery

T1040 Network Sniffing

Collection

T1557 Adversary-in-the-Middle

Impact

T1565.002 Transmitted Data Manipulation

Remediation for KAMSOFT ZSIRep certificate flaw

Patches

• ZSIRep CLIENT 2.12.3.1
• KS-SOMED 2026.03.0.01
• KS-PPS 2026.03.1.0
• KS-MEDIS 2026.03.0.0
• KS-SOLAB 2026.3.1.0
• KS-ASW 2026.3.0.1

Immediate actions

• Upgrade ZSIRep CLIENT library to 2.12.3.1 or later
• Upgrade dependent products: KS-SOMED 2026.03.0.01, KS-PPS 2026.03.1.0, KS-MEDIS 2026.03.0.0, KS-SOLAB 2026.3.1.0, KS-ASW 2026.3.0.1 (or later)
• Inventory hosts running ZSIRep CLIENT or the affected KAMSOFT products

Workarounds

• No vendor workaround published; until patched, restrict affected clients to trusted network paths and monitor for TLS interception on their egress

Longer-term hardening

• Audit in-house .NET code for process-wide certificate-validation callbacks that return true unconditionally
• Consider rotating credentials that were transmitted by affected clients over untrusted or shared network segments

Affected and fixed versions

• KAMSOFT — ZSIRep CLIENT library
  Vulnerable versions: all versions before 2.12.3.1
  Fixed in: 2.12.3.1
• KAMSOFT — KS-SOMED
  Vulnerable versions: before 2026.03.0.01
  Fixed in: 2026.03.0.01
• KAMSOFT — KS-PPS
  Vulnerable versions: before 2026.03.1.0
  Fixed in: 2026.03.1.0
• KAMSOFT — KS-MEDIS
  Vulnerable versions: before 2026.03.0.0
  Fixed in: 2026.03.0.0
• KAMSOFT — KS-SOLAB
  Vulnerable versions: before 2026.3.1.0
  Fixed in: 2026.3.1.0
• KAMSOFT — KS-ASW
  Vulnerable versions: before 2026.3.0.1
  Fixed in: 2026.3.0.1

Timeline of KAMSOFT ZSIRep certificate flaw

• 2026-06-01 Separate earlier locked-ioc-8 disclosure: CVE-2026-42251 (hard-coded credentials, CWE-798) in locked-ioc-5 published; unrelated flaw in the same vendor's product line.
• 2026-11-06 As of publication the advisory states no CVSS score, no exploitation, no proof of concept and no IOCs; NVD returned no record for the CVE at research time.
• 2026-11-06 Advisory credits locked-ioc-2 with responsibly reporting the vulnerability (reporting date not stated in the source).
• 2026-11-06 Advisory lists fixed releases: locked-ioc-3 2.12.3.1, locked-ioc-5 2026.03.0.01, locked-ioc-9 2026.03.1.0, locked-ioc-6 2026.03.0.0, locked-ioc-7 2026.3.1.0, locked-ioc-10 2026.3.0.1.
• 2026-11-06 CVE-2026-113618 (CWE-295, improper certificate validation) published; affects locked-ioc-3 before 2.12.3.1 and locked-ioc-5, locked-ioc-9, locked-ioc-6, locked-ioc-7, locked-ioc-10.
• 2026-11-06 locked-ioc-4 publishes the advisory for CVE-2026-113618 describing the missing server-certificate validation in the locked-ioc-8 locked-ioc-3 library.

Sources cited for KAMSOFT ZSIRep certificate flaw

• CERT Polska: Vulnerability in KAMSOFT ZSIRep CLIENT library (CVE-2026-113618) cert.pl · Advisory · 2026-11-06
• CVE Record: CVE-2026-113618 (cited by CERT Polska) CVE Program · Advisory · 2026-11-06
• NVD: CVE-2026-113618 (no record returned by NVD API at research time) NVD (NIST) · Advisory
• CERT Polska Coordinated Vulnerability Disclosure program cert.pl · Advisory
• Related prior KAMSOFT disclosure: CVE-2026-42251 hard-coded credentials in KS-SOMED cve.imfht.com · Research · 2026-06-01
• MITRE CWE-295:Improper Certificate Validation MITRE · Research
• MITRE ATT&CK T1557: Adversary-in-the-Middle MITRE · Research
• MITRE ATT&CK T1040: Network Sniffing MITRE · Research

More in vulnerability

• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10
• Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)
• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)