Vulnerability · Published Jul 27, 2026 · Assigned by CERT-PL

CVE-2026-57917Improper Restriction of XML External Entity Reference in proCertum SmartSign

Medium 4.8

In plain English

A medium-severity XML external entity in proCertum SmartSign from Asseco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.2%top 92.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerability is triggered simply by previewing a file in the file selection window, before the victim clicks “Open”. This issue was fixed in version 9.4.3.90.

Affected products (as reported)

Vendor	Product	Versions
Asseco	proCertum SmartSign	0 – before 9.4.3.90

Weakness: CWE-611 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/posts/2026/07/CVE-2026-57916 third-party-advisory
https://pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/ product