# SzafirHost software contained a signature-verification bypass (CVE-2026-44088) allowing…

Published: 2026-05-15 · Severity: high
Canonical: https://vorant.io/reports/9d65576d-6360-45ec-be44-da920d58c317/szafirhost-software-contained-a-signature-verification-bypass-cve-2026-44088

> SzafirHost software contained a signature-verification bypass (CVE-2026-44088) allowing remote code execution via crafted JAR files; patched in version 1.2.1.

CERT Polska coordinated disclosure of CVE-2026-44088, a signature-verification vulnerability in SzafirHost software. The flaw stems from a classic ZIP parser inconsistency: SzafirHost uses JarInputStream to verify the JAR signature by reading from the file's start, but uses JarFile/URLClassLoader to load classes by reading the Central Directory from the end. An attacker can exploit this by appending a malicious ZIP structure to a legitimately signed JAR, causing verification to pass while malicious code is loaded and executed. This represents a remote code execution risk for users of affected SzafirHost versions. The vulnerability was reported responsibly by Mariusz Maik and remediated in version 1.2.1. Organizations using SzafirHost should upgrade immediately to mitigate exploitation risk.

## Mentioned in this report

- Vulnerabilities: CVE-2026-44088

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Java Process (Possible Malicious JAR Execution)

ATT&CK: T1195.002

Detects a Java process (java.exe/javaw.exe) spawning a command interpreter or scripting host shortly after loading a JAR, consistent with execution of malicious code smuggled into a signed JAR via a JarInputStream/JarFile parsing mismatch (CVE-2026-44088 style supply-chain tampering). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Java Process
id: eda210b9-d605-558f-ba89-62641278e138
status: experimental
description: 'Detects command interpreters, script hosts, or LOLBins spawned directly
  from a Java Virtual Machine process.

  This can indicate exploitation of a signed-JAR trust bypass (e.g. CVE-2026-44088)
  where a malicious

  ZIP/JAR structure is appended after a legitimately signed JAR, passing signature
  verification while a

  malicious class is loaded and executed by URLClassLoader/JarFile, resulting in arbitrary
  code execution.

  '
references:
- CVE-2026-44088
author: Vorant
tags:
- attack.t1195.002
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  filter_build_tools:
    ParentCommandLine|contains:
    - maven
    - gradle
    - ant.jar
    - -jar surefire
  condition: selection and not filter_build_tools
falsepositives:
- Java-based build tools (Maven, Gradle, Ant) invoking shell commands as part of legitimate
  build/test tasks
- Installer wrappers that use a bundled JVM to launch platform-specific post-install
  scripts
level: medium
```

### Unsigned or Uncommon DLL Loaded by Java Process (Potential JAR Trust-Bypass Payload)

ATT&CK: T1574.001

Detects a Java process loading a DLL from outside the standard JRE/JDK installation paths, which can occur when a malicious class loaded via a signature-verification bypass (e.g. CVE-2026-44088) drops and loads a native library to achieve code execution or persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Uncommon DLL Loaded by Java Process
id: 1246cbf7-a962-560e-a9b1-db1335fd9c46
status: experimental
description: 'Detects native DLL loads by java.exe/javaw.exe from paths outside the
  typical JRE/JDK bin directories.

  Malicious JARs exploiting signature-verification bypass vulnerabilities (such as
  CVE-2026-44088) may load

  attacker-supplied native libraries after bypassing signature checks, achieving code
  execution via JNI or

  DLL side-loading.

  '
references:
- CVE-2026-44088
author: Vorant
tags:
- attack.t1574.001
- attack.persistence
- attack.defense_evasion
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    ImageLoaded|endswith: .dll
  filter_jre_paths:
    ImageLoaded|contains:
    - \jre\bin\
    - \jdk\bin\
    - \Java\jdk
    - \Java\jre
    - \Common Files\Oracle\
  filter_system_paths:
    ImageLoaded|contains:
    - \Windows\System32\
    - \Windows\SysWOW64\
  condition: selection and not 1 of filter_*
falsepositives:
- Legitimate third-party JNI libraries bundled with commercial Java applications and
  installed outside the JRE directory
- Custom enterprise Java applications that load native libraries from application
  install folders
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-44088

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9d65576d-6360-45ec-be44-da920d58c317/szafirhost-software-contained-a-signature-verification-bypass-cve-2026-44088.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup