# Płatnik software patches three auth flaws

Published: 2026-10-30 · Severity: routine · Sectors: Government (National)
Canonical: https://vorant.io/reports/4b591baf-f182-5c0e-9bc7-795b7fb423d9/p-atnik-software-patches-three-auth-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT Polska coordinated disclosure of three vulnerabilities in ZUS's Płatnik software allowing MITM attacks, weak password decoding, and authentication bypass; fixed in version 10.02.002 metric 242.

Source: cert.pl — https://cert.pl/en/posts/2026/10/CVE-2026-110970

## What to check

- Applies to: The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska disclosed three vulnerabilities in Płatnik, software maintained by Zakład Ubezpieczeń Społecznych (ZUS), Poland's Social Insurance Institution. The flaws affect all versions before metric 242 in version 10.02.002.

CVE-2026-110970 stems from Płatnik's use of unencrypted HTTP to download updates, libraries, and support files, enabling a man-in-the-middle attacker to intercept transmitted data or replace legitimate files with malicious ones. CVE-2026-110971 involves a weak password encoding algorithm, allowing anyone who obtains the encoded password to easily decode it. CVE-2026-110972 is the most severe: Płatnik performs client-side authentication, meaning an attacker with access to any application instance connected to the backend server can bypass login verification entirely and authenticate as an arbitrary user.

All three issues were fixed in Płatnik version 10.02.002, metric 242. There is no indication of in-the-wild exploitation; this is a coordinated vulnerability disclosure report. Defenders using Płatnik should update to the patched version immediately, given the combination of insecure update delivery and authentication bypass could allow full account impersonation and potential supply-chain-style tampering via the HTTP update mechanism.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110970, CVE-2026-110971, CVE-2026-110972

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-110970

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4b591baf-f182-5c0e-9bc7-795b7fb423d9/p-atnik-software-patches-three-auth-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup