PT-2026-45737 · Ditec A.S. · D.Launcher 2

Martin Orem · Publicado 2026-06-02 · Atualizado 2026-06-02 · CVE-2026-8993

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF (Server Side Request Forgery) attacks. User interaction is required as potential victim needs to open a specially crafted URL.

Correção

Information Disclosure

Special Elements Injection

Enumeração de Fraquezas

CWE-200

CWE-1395

CWE-74

Identificadores relacionados

CVE-2026-8993

Produtos afetados

D.Launcher 2

Referências · 3

• https://slovensko.sk/sk/oznamy/detail/_zranitelnost-aplikacie-d-launc · Nota
• https://ditec.sk/static/kep/apps/release-notes/en · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-8993 · Nota de Segurança