SzafirHost signature verification bypass enables remote code execution
SzafirHost software contained a signature-verification bypass (CVE-2026-44088) allowing remote code execution via crafted JAR files; patched in version 1.2.1.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-44088, a signature-verification vulnerability in SzafirHost software. The flaw stems from a classic ZIP parser inconsistency: SzafirHost uses JarInputStream to verify the JAR signature by reading from the file's start, but uses JarFile/URLClassLoader to load classes by reading the Central Directory from the end. An attacker can exploit this by appending a malicious ZIP structure to a legitimately signed JAR, causing verification to pass while malicious code is loaded and executed. This represents a remote code execution risk for users of affected SzafirHost versions. The vulnerability was reported responsibly by Mariusz Maik and remediated in version 1.2.1. Organizations using SzafirHost should upgrade immediately to mitigate exploitation risk.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Java Process (Possible Malicious JAR Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java process (java.exe/javaw.exe) spawning a command interpreter or scripting host shortly after loading a JAR, consistent with execution of malicious code smuggled into a signed JAR via a JarInputStream/JarFile parsing mismatch (CVE-2026-44088 style supply-chain tampering). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Java Process
id: eda210b9-d605-558f-ba89-62641278e138
status: experimental
description: 'Detects command interpreters, script hosts, or LOLBins spawned directly
from a Java Virtual Machine process.
This can indicate exploitation of a signed-JAR trust bypass (e.g. CVE-2026-44088)
where a malicious
ZIP/JAR structure is appended after a legitimately signed JAR, passing signature
verification while a
malicious class is loaded and executed by URLClassLoader/JarFile, resulting in arbitrary
code execution.
'
references:
- CVE-2026-44088
author: Vorant
tags:
- attack.t1195.002
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
filter_build_tools:
ParentCommandLine|contains:
- maven
- gradle
- ant.jar
- -jar surefire
condition: selection and not filter_build_tools
falsepositives:
- Java-based build tools (Maven, Gradle, Ant) invoking shell commands as part of legitimate
build/test tasks
- Installer wrappers that use a bundled JVM to launch platform-specific post-install
scripts
level: medium
Unsigned or Uncommon DLL Loaded by Java Process (Potential JAR Trust-Bypass Payload)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java process loading a DLL from outside the standard JRE/JDK installation paths, which can occur when a malicious class loaded via a signature-verification bypass (e.g. CVE-2026-44088) drops and loads a native library to achieve code execution or persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Uncommon DLL Loaded by Java Process
id: 1246cbf7-a962-560e-a9b1-db1335fd9c46
status: experimental
description: 'Detects native DLL loads by java.exe/javaw.exe from paths outside the
typical JRE/JDK bin directories.
Malicious JARs exploiting signature-verification bypass vulnerabilities (such as
CVE-2026-44088) may load
attacker-supplied native libraries after bypassing signature checks, achieving code
execution via JNI or
DLL side-loading.
'
references:
- CVE-2026-44088
author: Vorant
tags:
- attack.t1574.001
- attack.persistence
- attack.stealth
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith:
- \java.exe
- \javaw.exe
ImageLoaded|endswith: .dll
filter_jre_paths:
ImageLoaded|contains:
- \jre\bin\
- \jdk\bin\
- \Java\jdk
- \Java\jre
- \Common Files\Oracle\
filter_system_paths:
ImageLoaded|contains:
- \Windows\System32\
- \Windows\SysWOW64\
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate third-party JNI libraries bundled with commercial Java applications and
installed outside the JRE directory
- Custom enterprise Java applications that load native libraries from application
install folders
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-44088
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs