VORANT. Threat Intelligence Research Create a free account

Wirtualna Uczelnia SSTI flaw enables unauthenticated code execution

Published Vorant ratingroutine vulnerability Education

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Critical SSTI vulnerability in Wirtualna Uczelnia software allows unauthenticated remote code execution; reflected XSS also present in locale parameter handling.

Sourcecert.pl — open the original

What to check

Applies to
The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation
No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of two vulnerabilities affecting Wirtualna Uczelnia software. The primary issue, CVE-2026-34906, is a Server-Side Template Injection (SSTI) vulnerability that enables unauthenticated attackers to achieve Remote Code Execution. The flaw exists in the redirectToUrl endpoint's redirectUrlParameter, where inadequate input validation allows injection of arbitrary template expressions executed server-side. Exploitation permits attackers to execute remote commands and establish reverse shells without authentication.

A secondary vulnerability, CVE-2026-34907, involves Reflected Cross-Site Scripting (XSS) caused by insecure handling of the locale parameter across multiple endpoints. Attackers can weaponize this through crafted URLs containing JavaScript payloads that execute in victim browsers upon link activation.

Both vulnerabilities affect Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545. The issues were responsibly disclosed by Dawid Bakaj of VIPentest and coordinated through CERT Polska's vulnerability disclosure process.

Mentioned in this report

Vulnerabilities CVE-2026-34906CVE-2026-34907

Related reporting

Detection guidance

Web Application Process Spawning Shell Interpreter (Linux)

ATT&CK T1190 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects a Java/Tomcat/httpd web server process spawning a shell interpreter, consistent with SSTI/RCE exploitation such as CVE-2026-34906 in Wirtualna Uczelnia. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Application Process Spawning Shell Interpreter (Linux)
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /java
    - /tomcat
    - /httpd
    - /apache2
    - /nginx
    - /catalina.sh
  shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /zsh
  filter:
    CommandLine|contains:
    - logrotate
    - healthcheck
    - startup.sh
    - shutdown.sh
  condition: selection and shell and not filter
falsepositives:
- Legitimate deployment or startup/shutdown scripts invoked by the application server
- Monitoring or health-check scripts spawned by the web server process
level: high
tags:
- attack.t1190
- attack.t1059
id: 2662ba4c-3886-5e76-be80-055916a7ed42
status: experimental
author: Vorant

Web Server Process Spawning Command Interpreter (Windows)

ATT&CK T1190 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects java.exe, w3wp.exe, or tomcat service processes spawning cmd.exe or powershell.exe, indicative of RCE via SSTI exploitation against a web-facing Java application such as Wirtualna Uczelnia. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Interpreter (Windows)
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\java.exe
    - \\javaw.exe
    - \\w3wp.exe
    - \\tomcat9.exe
    - \\tomcat8.exe
    - \\httpd.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
  filter:
    CommandLine|contains:
    - C:\\Program Files\\Common Files
  condition: selection_parent and selection_child and not filter
falsepositives:
- Administrative scripts scheduled to run under the application pool identity
- Legitimate management tooling that shells out from the Java process for deployment
  tasks
level: high
tags:
- attack.t1190
- attack.t1059
id: 3829074e-3ad0-5fee-b9d8-9abe61d30096
status: experimental
author: Vorant

Outbound Reverse Shell Connection From Web Application Process

ATT&CK T1059 · status experimental · needs windows network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects a web server/Java process making an outbound network connection to a non-standard high port, consistent with reverse shell establishment following SSTI-based RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound Reverse Shell Connection From Web Application Process
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \\java.exe
    - \\javaw.exe
    - \\w3wp.exe
    - \\tomcat9.exe
    - \\tomcat8.exe
    - \\httpd.exe
    - \\sh
    - \\bash
  filter_ports:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter_ports
falsepositives:
- Application legitimately calling external APIs or update servers on non-standard
  ports
- Monitoring agents embedded in the application process communicating outbound
level: medium
tags:
- attack.t1059
- attack.t1185
- attack.t1190
id: 24fcf7e5-e64e-5504-b904-172da3e27603
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-34906

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs