Płatnik downloads updates over HTTP, enabling man-in-the-middle attacks (EUVD-2026-113774)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ZUS
- Product
- Płatnik
- First seen
Summary
EUVD-2026-113774 describes Płatnik, a product of Zakład Ubezpieczeń Społecznych, downloading updates, libraries and support files over HTTP, scored 2.3 under CVSS v3.1. The entry states that the issue was fixed, and it is reported here without independent verification.
If you use ZUS
Confirm that Płatnik is updated to the fixed version
Verify that update files come from trusted sources
Update Płatnik to version 10.02.002 or later
Reset Płatnik passwords after patching
Limit access to Płatnik accounts to authorized staff
Update Płatnik to the fixed release as soon as the vendor provides it
What the sources say 3
· Mastodon: “An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.” Source
· Mastodon: “Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it.” Source
· Mastodon: “It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.” Source