CVE-2026-113618 · Package
NO FIX YET · SEE WHAT TO DO
The ZSIRep client library for .NET registers a process-wide callback that accepts any server certificate without checking it. An attacker on the network path can impersonate the ZSIRep server and read or change authentication data and documents, and the callback also weakens other HTTPS connections in the same application.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any application that uses the ZSIRep client library is exposed, and the flaw applies to the process as a whole, not just the ZSIRep calls. The sources name KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB and KS-ASW as products that use the library. Exposure needs a man-in-the-middle position between the client and the ZSIRep server, so systems on a trusted network path are the main concern.
Not affected if library-version-2.12.3.1-or-later, no-zsirep-client-use
Who cares dotnet, ks-asw, ks-medis, ks-pps, ks-solab, ks-somed, zsirep
2.12.3.12026.03.0.012026.03.1.02026.03.0.02026.3.1.0The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.
The issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2026.3.0.1