EM-20261030-WT1X VulnerabilityHigh severity

Płatnik Vulnerability (CVE-2026-110972)

CVE-2026-110972

Status

Developing

Since Oct 30 12:16 UTC: signals keep joining.

First Signal: Oct 30 11:55 UTCC17 CERT Polska
Page Born: Oct 30 12:16 UTCsecond source joined
Last Signal: Oct 30 12:16 UTC5 days before snapshot
Sources: 21 official · 1 research, news or crowd
Open For: 5 daysso far

Life Of This Page

1
Born

Oct 30 12:16 UTC
A second, independent source names it.
2
Developing · Now

Oct 30 12:16 UTC
New signals join; severity can move.
3
Confirmed

Not yet
CISA KEV lists it, or exploitation in the wild is reported.
4
Resolved

Not yet
Past the fix deadline and 14 days with no new signal.
5
Archived

Not yet
30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

Disclosed: reached

Oct 30 12:16 UTC
C6 NVD published
Scored: reached

Oct 30 12:16 UTC
CVSS 8.6 · EPSS 0.2%
Exploited: not yet

Not yet
No exploitation reported
Advisories: reached

Oct 30 11:55 UTC
1 government and CERT sources
Vendor Response: not yet

Not yet
None in sources yet
Resolved: not yet

Not yet
After 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

Oct 30 12:16 UTCCVE-2026-110972 (CVSS 8.6) (opens source in a new tab) Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This is… High severityDatabaseC6 NVD CVE API 2.0
Oct 30 11:55 UTCVulnerabilities in Płatnik software (opens source in a new tab) CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-110970 to CVE-2026-110972) found in Płatnik software. Med severityGovernmentC17 CERT Polska