2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
ExecutionExploitation for Client Execution
Defense ImpairmentSubvert Trust Controls
Execution TA0002
T1203Exploitation for Client Execution×1
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.
CERT Polska coordinated the disclosure of CVE-2026-44088 in SzafirHost from Krajowa Izba Rozliczeniowa (KIR) on 2026-05-15: SzafirHost verifies the signature of a downloaded JAR file with JarInputStream, which reads from the beginning of the file, but loads classes with JarFile/URLClassLoader, which reads the ZIP Central Directory from the end (CERT Polska, 2026-05-15). An attacker who combines a genuine signed JAR with a malicious ZIP file therefore passes verification while the malicious class is loaded, which CERT Polska says can lead to remote code execution; all versions before 1.2.1 are affected and version 1.2.1 fixes the flaw (CERT Polska, 2026-05-15). ENISA's EUVD carries CERT-PL's CVSS 4.0 base score of 8.6, with a network attack vector, no privileges and active user interaction (ENISA EUVD-2026-30512). SzafirHost is the application that, with KIR's browser plugin and Java, signs documents and tax declarations with a qualified signature; accounting software prompts users to install the plugin and SzafirHost at the first signing attempt (wFirma help centre). CERT Polska does not say how a malicious JAR would reach SzafirHost, and no source reports exploitation.
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.
Links to install the KIR plugin and the Szafir Host application appear during the first signing attempt if they have not yet been installed on the device.
Where no such agreement exists, a qualified electronic signature based on a qualified certificate under foreign law is not recognised as being equivalent to a qualified electronic signature under Swiss law.
Switzerland does not recognise Polish qualified signatures under an eIDAS-equivalent framework: no mutual recognition agreement exists between Switzerland and the EU, and without one a foreign qualified signature is not equivalent to a qualified signature under Swiss law (BAKOM). CERT Polska states the impact as remote code execution from combining a genuine signed JAR with a malicious ZIP, in all SzafirHost versions before 1.2.1 (CERT Polska, 2026-05-15); it describes no attack on the download path, no silent signing of fraudulent documents and no list of public-sector workflows that depend on the helper. The CVSS 4.0 base score of 8.6 is CERT-PL's as the numbering authority, carried by ENISA's EUVD (ENISA EUVD-2026-30512).
threat17 May 05:00Zsingle-source · national CERTOpen finding →