Vulnerability · Published Jul 10, 2026 · Assigned by CERT-PL
CVE-2026-41879Weak password hashing in R-SOFT DMS
High 8.2
In plain English
A high-severity security flaw in DMS from R-SOFT SERWIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue was fixed in version v3.17-2000.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| R-SOFT SERWIS | DMS | 0 – before v3.17-2000 |
Weakness: CWE-328 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://cert.pl/posts/2026/07/CVE-2026-41876 third-party-advisory