| CVE ID | CVE-2026-113618 |
| Publication date | 06 November 2026 |
| Vendor | KAMSOFT |
| Product | ZSIRep CLIENT library |
| Vulnerable versions | All before 2.12.3.1 |
| Vulnerability type (CWE) | Improper Certificate Validation (CWE-295) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerability in KAMSOFT ZSIRep CLIENT library and participated in coordination of its disclosure.
The vulnerability CVE-2026-113618: The ZSIRep client library (ZSIREP.CLIENT.DLL) does not validate server certificate. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.
The issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).
Credits
We thank Kajetan Pawelec for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.