PT-2026-132217

CVE-2026-106036

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 4.0
6.9
Medium
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-295: Improper Certificate Validation
Related identifiers
CVE-2026-106036
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com