CVE-2026-0392

CVE-2026-0392 affects eParakstītājs, Latvia's electronic signature software. The vulnerability is straightforward: the application's update checker uses a permissive TrustManager and HostnameVerifier that both return true unconditionally, bypassing TLS certificate and hostname validation entirely. Additionally, downloaded update executables run without Authenticode signature verification. An attacker on the same network as a victim—or controlling any hop between the client and the update server—can inject arbitrary code into the update flow and achieve code execution with the privileges of the signed application. This is not a sophisticated vulnerability. The 'always returns true' TrustManager pattern is debug code that migrated to production, likely copied from a Stack Overflow answer or dev environment workaround. What makes this significant is the blast radius: eParakstītājs sits at the root of trust for digital signatures in Latvia. Compromising it doesn't just give you one machine—it gives you the ability to sign documents that other systems will accept as cryptographically trusted. The signed artifacts persist in government registries, contract databases, and audit trails long after the vulnerability is patched. There is a structural remediation problem here that standard CVE notes miss: the vulnerable component is the update mechanism itself. Users cannot receive the fix through the application's automatic update feature—they must manually download version 1.10.0 from the vendor's website or perform a fresh install. If your deployment model relies on the application updating itself, that channel is currently compromised. Your incident response plan should assume users will not receive this patch automatically. From a defensive prioritization standpoint: despite the low EPSS score, this warrants immediate attention. EPSS measures opportunistic scanning activity, not targeting by sophisticated actors. Electronic signature infrastructure for a national government is exactly the kind of high-value, specific target that state actors enumerate quietly. The absence of active exploitation in threat feeds does not indicate low risk—it indicates the target is not yet noisy. Check your estate for Java applications using custom TrustManager implementations, particularly in update or bootstrap code. SAST tools should flag any TrustManager that doesn't throw an exception on validation failure. The absence of such a check in your pipeline is the underlying failure that allowed this to ship.

Reviewed through automated stages and approved by a human before publication.