CVE-2026-8931

Critical RCE vulnerability in Disig Web Signer

View on CVE.org
Published Jun 1, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.

Analysis

AI-generated

Technical impact

A vulnerability in Disig Web Signer allows an attacker to execute arbitrary code on the host system. The flaw is present in versions 2.0.3 through 2.5.3 and can be triggered by a remote attacker.

Affected Systems

Disig Web Signer versions 2.0.3 to 2.5.3 are affected. No other vendors or product lines are listed as impacted.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. EPSS data is not available, so the exploitation probability is unknown, but the absence from the KEV catalog does not negate risk. The likely attack vector is a remote user submitting a crafted request to the Web Signer application, probably via its web UI or API endpoint. Successful exploitation could give the attacker a full shell on the system hosting the application.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Disig Web Signer update that includes the fix for the RCE (any release 2.6.0 or newer).
  • If a swift upgrade is not possible, restrict external access to the Web Signer service by applying firewall rules that allow traffic only from trusted IP addresses or by placing the service behind a VPN.
  • Deploy a web application firewall or similar protection to detect and block anomalous or malicious requests targeting Web Signer endpoints.

Generated by OpenCVE AI on June 1, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Disig
Disig web Signer
Vendors & Products Disig
Disig web Signer
Type Values Removed Values Added
Weaknesses CWE-94
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.
Title Critical RCE vulnerability in Disig Web Signer
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}
Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
SK-CERT
Published
Updated
Jun 1, 2026, 3:31 PM
Reserved
May 19, 2026, 8:34 AM

View source JSON

Updated
Jun 1, 2026, 3:31 PM

JSON

Status
Deferred
Published
Jun 1, 2026, 3:16 PM
Modified
Jul 22, 2026, 7:10 AM

View source JSON

No data.

Updated
Jun 2, 2026, 8:54 PM

JSON