VULNERABILITY INTELLIGENCE
CVE-2026-8993
CVSS score6.5 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-06-02
Last modified2026-07-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Description
D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF (Server Side Request Forgery) attacks. User interaction is required as potential victim needs to open a specially crafted URL.
Weakness classification
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor