CVE-2026-110970
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Płatnik uses the HTTP protocol to download updates, libraries, and support files. This allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data, and replace the original files with their own. The issue was fixed in metric 242 in version 10.02.002.
Risk Assessment
An attacker in a MITM position can intercept data transmitted by the application and deliver modified files, potentially leading to code execution or information disclosure. The risk affects organizations using Płatnik to download updates over insecure connections.
Recommendation
Update Płatnik to version 10.02.002 or later, which includes the fix in metric 242. Until updated, avoid downloading updates and libraries over untrusted networks.
Other vulnerabilities in Płatnik
See all- CVE-2026-110972High
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.
- CVE-2026-110971High
Płatnik software uses a weak password encoding algorithm, allowing a user who obtains an encoded password to easily decode it. This issue was fixed in metric 242 in version 10.02.002.
Original NVD description (English source)
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS