VulnSocial

CVE-2026-0392Disclosure

LOWCVSS 7.3 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-295CWE-347CWE-494

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-08-15)
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-08-04: 1Mentions · 2026-08-14: 1Mentions · 2026-08-15: 2Patch / Workaround · 2026-08-15: 108-0408-1408-15
Signal classification2 categories
Disclosure
250.0%
General
250.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-08-041
Disclosure1
2026-08-141
General1
2026-08-152
Disclosure1General1
Full discourse4 posts
  • CERT@certlv
    Disclosure

    Nozīmīgs solis Latvijas CVD programmas attīstībā -pirmajai http://cvd.cert.lv platformā pieteiktajai ievainojamībai piešķirts CVE numurs. Par ievainojamību: https://euvd.enisa.europa.eu/vulnerability/CVE-2026-0392 💡 Ziņo par ievainojamībām atbildīgi https://cvd.cert.lv un palīdz veidot drošāku vidi.

    Post summary

    The post announces that a new vulnerability has been assigned a CVE number within the Latvian CVD program and provides a link to its official EU VDP entry, encouraging responsible reporting, but offers no technical, exploit, or patch information.

    0401121.4K
    5.7K followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Disclosure

    CVE-2026-0392 eParakstītājs 3.0の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/09/cve-2026-0392-eparakstitajs-30/ #IT #Security #cybersecurity

    Post summary

    The text announces an explanatory article on CVE‑2026‑0392 in eParakstītājs 3.0, offering mitigations but lacking concrete exploit details or evidence of active exploitation.

    0000038
    213 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    CVE-2026-0392 eParakstītājs 3.0の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/09/cve-2026-0392-eparakstitajs-30/ #IT #Security #cybersecurity

    Post summary

    The snippet presents an article that explains CVE‑2026‑0392, outlining its impact scope and summarizing potential mitigations, but it offers no concrete PoC, exploit code, active usage claim, patch information, or technical depth.

    0000047
    213 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    General

    CVE-2026-0392 eParakstītājs 3.0の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/09/cve-2026-0392-eparakstitajs-30/ #IT #Security #cybersecurity

    Post summary

    The provided text merely announces an article link about CVE-2026-0392 without offering any technical, exploit, patch, or active exploitation information.

    0000042
    213 followersView on X

Explore more

Back to dashboard