ZUS Płatnik software vulnerabilities identified

CERT Polska has coordinated the disclosure of several security vulnerabilities found in the Płatnik software, which is maintained by the Polish Social Insurance Institution (Zakład Ubezpieczeń Społecznych).

The identified vulnerabilities include:

• CVE-2026-110970: The software uses the unencrypted HTTP protocol to download updates, libraries, and auxiliary files, which could allow for Man-In-The-Middle attacks and data interception.

• CVE-2026-110971: The use of a weak password encoding algorithm allows users who obtain an encoded password to decode it easily.

• CVE-2026-110972: Client-side authentication processes could allow an attacker with access to an application instance to bypass the login process and authenticate as any user.

These issues have been addressed in version 10.02.002.