# CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library

> CERT Polska reports that the KAMSOFT ZSIRep CLIENT library does not validate server certificates and registers a process-wide .NET callback that accepts any certificate for HTTPS connections. A network-positioned attacker can perform man-in-the-middle interception of authentication data and documents. Fixed in ZSIRep CLIENT 2.12.3.1 and corresponding KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB and KS-ASW releases.

- **Published:** 2026-11-06T14:23:52Z
- **Last reviewed:** 2026-11-06T14:23:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5422
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5422.png
- **ID:** TL-2026-5422
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2026-113618, CVE-2026-42251

## Description

CVE-2026-113618 is an improper certificate validation weakness (CWE-295) in the KAMSOFT ZSIRep CLIENT library, disclosed by CERT Polska on 2026-11-06. According to the advisory, the library does not validate the server certificate of the HTTPS endpoints it connects to. Instead it registers a process-wide .NET certificate-validation callback that accepts any certificate without verification.

Because TLS server authentication is effectively disabled, an attacker who can position themselves between the client and the server (adversary-in-the-middle) can present an arbitrary certificate and transparently intercept the traffic. The advisory states this exposes authentication data and documents exchanged by the client. The advisory also notes that the callback persists after the client is closed, so other HTTPS connections made within the same application process may also lose certificate validation.

Affected: all ZSIRep CLIENT library versions before 2.12.3.1, and the dependent KAMSOFT products KS-SOMED (before 2026.03.0.01), KS-PPS (before 2026.03.1.0), KS-MEDIS (before 2026.03.0.0), KS-SOLAB (before 2026.3.1.0) and KS-ASW (before 2026.3.0.1). The reporter is credited as Kajetan Pawelec.

Evidence limits: the source publishes no CVSS score, no exploitation status, no proof of concept, no timeline and no mitigation guidance beyond the fixed versions. No indicators of compromise are published; the IOC entries below are affected-component and behavioral indicators for exposure assessment, not evidence of active exploitation. The NVD API returned no record for this CVE at research time. Severity MEDIUM is an analyst-assigned placeholder pending official scoring (exploitation requires a man-in-the-middle network position, but the data exposed includes authentication material and documents); cvss_score is intentionally null.

## MITRE ATT&CK

- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1040 Network Sniffing
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vulnerable KAMSOFT ZSIRep CLIENT Library Loaded (CVE-2026-113618) [Splunk SPL]** (`TL-2026-5422-SPL-001`)

Identifies hosts where ZSIREP.CLIENT.DLL is loaded and (SPL) compares FileVersion against the fixed 2.12.3.1. Affected builds register a process-wide .NET certificate-validation callback that accepts any TLS certificate (CWE-295), so these hosts are exposed to adversary-in-the-middle interception and modification of authentication data and documents. Exposure finding, not evidence of exploitation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1040, T1565.002
- **Data sources:** sysmon, windows_defender_atp
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 ImageLoaded="*\\ZSIREP.CLIENT.DLL" earliest=-24h
| eval ver=split(FileVersion,".")
| eval v1=tonumber(mvindex(ver,0)), v2=tonumber(mvindex(ver,1)), v3=tonumber(mvindex(ver,2)), v4=tonumber(mvindex(ver,3))
| eval vulnerable=case(isnull(v1),1, v1<2,1, v1==2 AND v2<12,1, v1==2 AND v2==12 AND v3<3,1, v1==2 AND v2==12 AND v3==3 AND v4<1,1, true(),0)
| where vulnerable=1
| stats count min(_time) as first_seen max(_time) as last_seen values(FileVersion) as file_version values(Image) as host_process by host, ImageLoaded
```

### Microsoft KQL

```kql
// CVE-2026-113618: hosts loading ZSIREP.CLIENT.DLL. Compare SHA256 / product version against the fixed 2.12.3.1 build.
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "ZSIREP.CLIENT.DLL"
| project Timestamp, DeviceName, DeviceId, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessFolderPath
| summarize LoadCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Processes=make_set(InitiatingProcessFileName) by DeviceName, FolderPath, SHA256
```

### Sigma

```yaml
title: KAMSOFT ZSIRep CLIENT Library Loaded (CVE-2026-113618 Exposure)
id: 6f1c2a4e-5b7d-4c3a-9e10-3a5d8b2f1c01
status: experimental
description: Detects a process loading ZSIREP.CLIENT.DLL. Versions before 2.12.3.1 register a process-wide .NET certificate validation callback that accepts any certificate (CWE-295), enabling adversary-in-the-middle interception. Use for exposure inventory and verify the file version.
references:
  - https://cert.pl/en/posts/2026/11/CVE-2026-113618/
  - https://attack.mitre.org/techniques/T1557/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.credential-access
  - attack.collection
  - attack.impact
  - attack.t1557
  - attack.t1040
  - attack.t1565.002
  - cve.2026.113618
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '\ZSIREP.CLIENT.DLL'
  condition: selection
falsepositives:
  - Patched ZSIRep CLIENT 2.12.3.1 or later (Sigma cannot compare file versions; filter by hash or version downstream)
  - Legitimate KAMSOFT KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB and KS-ASW operation
level: medium

```

**Known false positives:**

- Hosts already upgraded to ZSIRep CLIENT 2.12.3.1 or later (KQL and Sigma do not compare versions)
- Authorised KAMSOFT product usage during the patch window

**Tuning notes:** Keep a hash or version allow-list of fixed ZSIREP.CLIENT.DLL builds. Requires Sysmon Event ID 7 (ImageLoad) enabled for the KAMSOFT install paths. Treat hits as exposure findings, not evidence of exploitation; prioritise hosts on shared or untrusted network segments.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unpatched KAMSOFT Products Installed: [indicator], [indicator], [indicator], [indicator], [indicator], ZSIRep (CVE-2026-113618) [Sentinel KQL] (locked: unlock with TL Creds)
- Root Certificate Store Tampering on Hosts (Trusted Interception Prep) [Sentinel KQL] (locked: unlock with TL Creds)
- Proxy or PAC Redirection Configured on [indicator] Hosts (Traffic Redirection) [Sentinel KQL] (locked: unlock with TL Creds)
- Linux AiTM Toolkit Execution: bettercap, ettercap, arpspoof, mitmproxy, Responder [Sigma] (locked: unlock with TL Creds)
- Inveigh and LLMNR/NBT-NS/mDNS Poisoning Frameworks in PowerShell Script Blocks [Sigma] (locked: unlock with TL Creds)
- Windows Built-in Packet Capture: netsh trace, pktmon, Npcap/WinPcap Service Install [Sigma] (locked: unlock with TL Creds)
- AiTM and Packet Capture Tool Execution on Windows Endpoints (CVE-2026-113618 context) [Splunk SPL] (locked: unlock with TL Creds)
- [indicator] Process Connecting to New HTTPS Destination (Possible Server Impersonation) [Splunk SPL] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CERT Polska: Vulnerability in KAMSOFT ZSIRep CLIENT library (CVE-2026-113618)](https://cert.pl/en/posts/2026/11/CVE-2026-113618/)
- [CVE Record: CVE-2026-113618 (cited by CERT Polska)](https://www.cve.org/CVERecord?id=CVE-2026-113618)
- [NVD: CVE-2026-113618 (no record returned by NVD API at research time)](https://nvd.nist.gov/vuln/detail/CVE-2026-113618)
- [Related prior KAMSOFT disclosure: CVE-2026-42251 hard-coded credentials in KS-SOMED](https://cve.imfht.com/detail/CVE-2026-42251)
- [CERT Polska Coordinated Vulnerability Disclosure program](https://cert.pl/en/cvd/)
- [MITRE CWE-295:Improper Certificate Validation](https://cwe.mitre.org/data/definitions/295.html)
- [MITRE ATT&CK T1557: Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)
- [MITRE ATT&CK T1040: Network Sniffing](https://attack.mitre.org/techniques/T1040/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5422