KAMSOFT KS-SOMED hardcoded FTP credentials patched

1 June 2026 high vulnerability

A hardcoded credential vulnerability in KAMSOFT KS-SOMED allowed attackers to upload malicious updates via FTP, potentially compromising client systems.

CERT Polska coordinated the disclosure of CVE-2026-42251, a hardcoded credential vulnerability in KAMSOFT's KS-SOMED software. The flaw allowed unauthorized attackers to access the FTP server hosting application updates using embedded credentials. An attacker exploiting this vulnerability could upload malicious update packages that would be distributed and installed on client machines as legitimate updates, providing a supply-chain attack vector.

The vulnerability affected KS-SOMED modules KSPLUPDFTP.exe up to version 30.00.00.056 and ANEKSKLIENT.EXE up to version 29.00.02.026. KAMSOFT has remediated the issue by removing hardcoded credentials from the code, modifying the update process, and restricting previously exposed credentials to read-only access.

The vulnerability was responsibly disclosed by security researcher Wojciech Giełda. While CERT Polska has confirmed the vulnerability and coordinated its disclosure, there is no indication of active exploitation in the wild.

Mentioned in this report

Vulnerabilities CVE-2026-42251

Detection guidance

Suspicious Child Process Spawned by KAMSOFT KS-SOMED Update Client

ATT&CK T1554

Detects KS-SOMED update binaries (KSPLUPDFTP.exe / ANEKSKLIENT.EXE) spawning script or living-off-the-land interpreters, which could indicate execution of a malicious update package delivered via the hardcoded FTP credential vulnerability (CVE-2026-42251). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by KAMSOFT KS-SOMED Update Client
id: f384d48e-382c-5380-ae38-ebaaaf96ec3f
status: experimental
description: Detects the KS-SOMED update client executables (KSPLUPDFTP.exe, ANEKSKLIENT.EXE)
  launching command interpreters or scripting engines, a pattern consistent with a
  malicious update package being executed as a trusted software update after supply-chain
  compromise via CVE-2026-42251.
references:
- CERT Polska CVE-2026-42251 advisory
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\KSPLUPDFTP.exe
    - \\ANEKSKLIENT.EXE
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\regsvr32.exe
    - \\wscript.exe
    - \\cscript.exe
  condition: selection
falsepositives:
- Legitimate KS-SOMED update installer invoking a post-install script or batch file
  as part of a normal upgrade
- IT administrator manually running maintenance scripts immediately after an update
  completes
level: high
tags:
- attack.t1554
- attack.t1195.002

KAMSOFT KS-SOMED Update Client Establishing FTP Connection

ATT&CK T1195.002

Flags outbound FTP connections initiated by the KS-SOMED update binaries for review, since the update mechanism used hardcoded credentials to an FTP server and could be redirected or abused to fetch attacker-supplied update packages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: KAMSOFT KS-SOMED Update Client Establishing FTP Connection
id: bc1c0698-f66e-5e87-b4c1-2c6c80c88487
status: experimental
description: Detects the KS-SOMED update client executables (KSPLUPDFTP.exe, ANEKSKLIENT.EXE)
  initiating outbound connections on FTP ports. Given CVE-2026-42251 exposed hardcoded
  FTP credentials used by this update channel, connections to unexpected or non-corporate
  FTP hosts should be validated to rule out delivery of a malicious update package.
references:
- CERT Polska CVE-2026-42251 advisory
author: Vorant
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \\KSPLUPDFTP.exe
    - \\ANEKSKLIENT.EXE
    DestinationPort:
    - 21
    - 990
  condition: selection
falsepositives:
- Scheduled legitimate check-in of the KS-SOMED update client to KAMSOFT's official
  FTP update host
level: low
tags:
- attack.t1195.002

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-42251

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free