A library shipped inside several KAMSOFT applications trusted every HTTPS certificate it was shown, CERT Polska disclosed on 6 November. That means an attacker sitting between the software and its server could pretend to be the server and quietly read or change what passes through, including authentication data and documents.
The flaw, tracked as CVE-2026-113618 (CWE-295, improper certificate validation), sits in the ZSIRep CLIENT library, ZSIREP.CLIENT.DLL. It was reported by researcher Kajetan Pawelec, and CERT Polska coordinated the disclosure. No CVSS score was published alongside the advisory.
One callback weakens the whole application
Certificate validation is how an HTTPS client confirms it is really talking to the server it meant to reach. According to CERT Polska, the ZSIRep library registers a process-wide .NET callback that accepts any certificate without checking it. Two consequences follow from that design.
First, a man-in-the-middle attacker can impersonate the ZSIRep server and intercept or modify authentication data and documents. Second, because the callback is process-wide and persists after the ZSIRep client is closed, it also weakens every other HTTPS connection the same application makes. A bug in one component therefore lowers the bar for the host program's other network traffic as well.
It is the latest in a run of CERT Polska-coordinated disclosures that have turned up basic security gaps in Polish business software, following hard-coded API logins in drEryk Gabinet and the CGM CLININET flaws.
Update to library 2.12.3.1 or the fixed app releases
All versions of the library before 2.12.3.1 are affected, and that release fixes it. Because the library is bundled, most organisations will get the fix by updating the application that carries it. CERT Polska lists these fixed versions:
- KS-SOMED 2026.03.0.01
- KS-PPS 2026.03.1.0
- KS-MEDIS 2026.03.0.0
- KS-SOLAB 2026.3.1.0
- KS-ASW 2026.3.0.1
Administrators running any of these products should confirm they are on at least the listed release. There is no exploitation reported, but a flaw like this only needs an attacker positioned on the network path between the application and its server to be useful. More on Poland's threat picture is on our Poland country page.
Encryption that never checks who is on the other end protects nothing, and the fix here is a version number away.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.