# SzafirHost JAR signature bypass enables RCE

Published: 2026-05-15 · Severity: high
Canonical: https://vorant.io/reports/d30468b1-8cc8-5637-bb6b-cd0612f1ef72/szafirhost-jar-signature-bypass-enables-rce

> CVE-2026-44088 in SzafirHost allows attackers to bypass JAR signature verification by exploiting inconsistent reading methods, enabling remote code execution; fixed in version 1.2.1.

CERT Polska has disclosed CVE-2026-44088, a vulnerability in SzafirHost software that allows remote code execution through a JAR signature verification bypass. The flaw stems from SzafirHost using different methods to verify and load JAR files: JarInputStream reads from the beginning of the file for signature verification, while JarFile/URLClassLoader reads from the Central Directory at the end for class loading.

An attacker can exploit this inconsistency by crafting a polyglot file that combines a legitimately-signed JAR with a malicious ZIP archive. The verification process checks the signed portion and passes, but the class loader reads the malicious classes from the end of the file, resulting in arbitrary code execution. The vulnerability has been addressed in SzafirHost version 1.2.1.

The issue was responsibly disclosed by researcher Mariusz Maik and coordinated through CERT Polska's vulnerability disclosure process. Organizations using SzafirHost should upgrade to version 1.2.1 or later to mitigate this risk.

## Mentioned in this report

- Vulnerabilities: CVE-2026-44088

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Java Process (Possible SzafirHost JAR RCE)

ATT&CK: T1059

Detects a Java runtime process (java/javaw, e.g. hosting SzafirHost) spawning a command/script interpreter, consistent with post-exploitation of the JAR signature verification bypass (CVE-2026-44088) leading to arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from Java Process
id: 797fe06d-15ad-58b7-9a87-e6005187b7dc
status: experimental
description: Detects a Java process (java.exe/javaw.exe) spawning a command-line interpreter
  or scripting engine, which is consistent with exploitation of CVE-2026-44088, a
  JAR signature verification bypass in SzafirHost that results in arbitrary code execution
  when a polyglot JAR/ZIP file is loaded by the class loader.
references:
- CERT Polska CVE-2026-44088 SzafirHost advisory
author: Vorant
tags:
- attack.t1059
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
  filter_known_admin:
    CommandLine|contains:
    - -jar C:\Program Files
    - ChildProcessLauncher
  condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
- Legitimate Java applications that intentionally launch native helper scripts or
  update utilities
- Build/deployment tools running Java-based automation that shells out to system utilities
level: high
```

### JAR File Written with Trailing Data After Central Directory (Polyglot JAR Indicator)

ATT&CK: T1195.001

Detects creation of a .jar file where a secondary ZIP/class payload is appended after the legitimate signed archive, a structural indicator of the SzafirHost JarInputStream/JarFile verification mismatch used to smuggle malicious classes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: JAR File Dropped With Anomalous Trailing Archive Structure
id: 92e7b35f-ac36-58b0-8962-f0567d40bba7
status: experimental
description: Detects file write events for .jar files immediately followed by process
  activity indicating dual-parsing tooling (verification then load) may have been
  exploited, as seen in CVE-2026-44088 where a polyglot JAR/ZIP bypasses JarInputStream
  signature checks but loads malicious classes via JarFile/URLClassLoader reading
  from the Central Directory. This rule flags the software supply chain artefact (dropped/updated
  jar in application or plugin directories outside normal package management) for
  follow-up review rather than the byte-level polyglot structure, which requires deeper
  file inspection.
references:
- CERT Polska CVE-2026-44088 SzafirHost advisory
author: Vorant
tags:
- attack.t1195.001
- attack.initial_access
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .jar
  filter_package_manager:
    Image|endswith:
    - \msiexec.exe
    - \TrustedInstaller.exe
  condition: selection and not filter_package_manager
falsepositives:
- Normal application updates or plugin installations that legitimately drop new jar
  files
- Build systems or CI/CD pipelines writing jar artefacts to deployment directories
level: low
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-44088

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d30468b1-8cc8-5637-bb6b-cd0612f1ef72/szafirhost-jar-signature-bypass-enables-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup