Vulnerability · Published Jun 2, 2026 · Assigned by SK-CERT

CVE-2026-8993Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

Medium 6.5

In plain English

A medium-severity injection in D.Launcher 2 from Ditec a.s.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 86.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF (Server Side Request Forgery) attacks. User interaction is required as potential victim needs to open a specially crafted URL.

Affected products (as reported)

Vendor	Product	Versions
Ditec a.s.	D.Launcher 2	0 – before 2.0.7

Weakness: CWE-74, CWE-200, CWE-1395 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References