Weak Password Encoding Vulnerability in Płatnik Software by ZUS
CVE-2026-110971

7.7HIGH

Key Information:

Vendor

Zakład Ubezpieczeń Społecznych

Status
Płatnik
Vendor
CVE Published:
30 October 2026

What is CVE-2026-110971?

The Płatnik software by ZUS exhibits a vulnerability due to its reliance on a weak password encoding algorithm. This flaw allows an unauthorized user, who gains access to an encoded password, to easily decode it, posing a risk to user data and security. It is crucial for users to upgrade to version 10.02.002, which addresses this issue and enhances the security measures of the application.

Affected Version(s)

Płatnik 0 <= 10.02.002

References

https://cert.pl/posts/2026/10/CVE-2026-110970
third-party-advisory
https://www.zus.pl/firmy/program-platnik/o-programie-platnik
product

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wojciech Giełda
.