proCertum SmartSign flaws enable code execution
Two vulnerabilities in proCertum SmartSign let attackers execute arbitrary files or trigger SSRF/local file reads via malicious certificates or signature files, fixed in 9.4.3.90.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities affecting proCertum SmartSign, a digital signature application. CVE-2026-57916 stems from missing schema validation when the software opens a Certificate Practice Statement (CPS) URI embedded in a certificate; an attacker can craft a certificate whose CPS URI points to a local executable or arbitrary URL, sign a document with it, and have the executable run or webpage open automatically when the victim opens the signed document in SmartSign.
CVE-2026-57917 is an XML External Entity (XXE) vulnerability triggered when SmartSign parses crafted signature files. Notably, the flaw fires simply by previewing a file in the file selection dialog, before the victim clicks "Open," enabling SSRF and potentially local file disclosure depending on the underlying XML parser's configuration.
Both issues were addressed in proCertum SmartSign version 9.4.3.90. The vulnerabilities were reported by researcher Mariusz Maik and coordinated through CERT Polska's standard disclosure process. There is no indication of active exploitation in the wild; this is a vendor-patched disclosure requiring users to update to the fixed version.
Mentioned in this report
Detection guidance
proCertum SmartSign Spawning Process Outside Install Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SmartSign.exe launching a child process located outside its own program directory, consistent with CVE-2026-57916 where a crafted certificate's CPS URI causes SmartSign to execute an arbitrary local executable when a signed document is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: proCertum SmartSign Spawning Process Outside Install Directory
description: SmartSign (proCertum digital signature viewer) normally only launches
its own bundled helper binaries. CVE-2026-57916 allows a maliciously crafted certificate's
CPS URI to make SmartSign execute an arbitrary local executable when the victim
opens a signed document. This rule flags SmartSign spawning any child process that
does not reside in the expected proCertum install path.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \SmartSign.exe
filter_install_dir:
Image|startswith:
- C:\Program Files\proCertum\
- C:\Program Files (x86)\proCertum\
condition: selection and not filter_install_dir
falsepositives:
- Legitimate proCertum SmartSign helper tools or updaters installed outside the default
program directory
- Third-party PKI middleware integrations that hook into SmartSign's process tree
level: high
id: 7fee9697-de67-587b-a71a-a365ea6597ff
status: experimental
author: Vorant
proCertum SmartSign Auto-Launching Web Browser on Document Open
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SmartSign.exe spawning a web browser process, consistent with CVE-2026-57916 where an embedded CPS URI pointing to an arbitrary URL is automatically opened when a signed document is viewed. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: proCertum SmartSign Auto-Launching Web Browser on Document Open
description: CVE-2026-57916 lets an attacker craft a certificate whose Certificate
Practice Statement (CPS) URI points to an arbitrary web page, which SmartSign opens
automatically in the default browser when the victim opens a signed document. This
is unusual behaviour for a signature-verification utility and indicates the CPS
URI feature is being abused rather than used to view a legitimate CPS notice hosted
by the issuing CA.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \SmartSign.exe
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \iexplore.exe
condition: selection
falsepositives:
- User manually clicking a legitimate CPS link surfaced by SmartSign for a trusted,
known certificate authority
level: medium
id: a1779dcb-1f99-5608-9fcd-c06d0c99548c
status: experimental
author: Vorant
proCertum SmartSign Outbound Network Connection During File Preview
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SmartSign.exe initiating an outbound network connection, consistent with CVE-2026-57917 where an XXE flaw in signature file parsing triggers SSRF simply by previewing a file in the open dialog, before the user clicks Open. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: proCertum SmartSign Outbound Network Connection During File Preview
description: CVE-2026-57917 is an XXE vulnerability triggered when SmartSign parses
a crafted signature file, firing as soon as the file is previewed in the selection
dialog (before the user opens it). This can cause SSRF-style outbound requests to
attacker-controlled or internal hosts. Legitimate SmartSign operation should not
require the process to make outbound network connections merely to preview a local
file.
tags:
- attack.execution
- attack.t1203
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \SmartSign.exe
Initiated: 'true'
filter_local:
DestinationIp|startswith:
- '127.'
- '10.'
- 192.168.
condition: selection and not filter_local
falsepositives:
- Legitimate CRL/OCSP revocation checks performed by SmartSign against the certificate
issuer's endpoints when actually opening (not merely previewing) a signed document
- Software update checks made by SmartSign itself
level: medium
id: 0f9a80b6-7cc0-51a5-ae89-9d900815b459
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-57916
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs