Is CVE-2026-110971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110971 being exploited in the wild.

How severe is CVE-2026-110971?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Zakład Ubezpieczeń Społecznych Płatnik up to metric 242 in version 10.02.002.

Is there a fix for CVE-2026-110971?

Yes: fixed in 10.02.002 (metric 242). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110971 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-110971?

Check whether you run Zakład Ubezpieczeń Społecznych Płatnik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110971: Płatnik weak password encoding vulnerability

CVE-2026-110971 · Severity: info · Published 2026-10-30

Płatnik is a social security software used by Poland's ZUS for managing benefits and contributions. The application uses a weak password encoding algorithm that allows anyone who obtains an encoded password to easily decode it, risking unauthorized access to sensitive social security records and personal information.

Technologies: Zakład Ubezpieczeń Społecznych Płatnik. Vendors: Zakład Ubezpieczeń Społecznych.

Quick answers

Is CVE-2026-110971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110971 being exploited in the wild.
How severe is CVE-2026-110971?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Zakład Ubezpieczeń Społecznych Płatnik up to metric 242 in version 10.02.002.
Is there a fix for CVE-2026-110971?: Yes: fixed in 10.02.002 (metric 242). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110971 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-110971?: Check whether you run Zakład Ubezpieczeń Społecznych Płatnik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.02.002 (metric 242)

Technical details

The vulnerability is a weak password encoding scheme (CWE-261) in the Płatnik application. An attacker who gains access to an encoded password can trivially reverse it to obtain the plaintext password, potentially leading to unauthorized system access. The vulnerability affects all versions up to metric 242 in version 10.02.002, where it was fixed.

Affected products

Zakład Ubezpieczeń Społecznych Płatnik up to metric 242 in version 10.02.002

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.