What’s Vulnerable › Vulnerabilities

CVE-2026-8993: Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-02 · updated 2026-07-22
• Weakness: CWE-74

Description

D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF (Server Side Request Forgery) attacks. User interaction is required as potential victim needs to open a specially crafted URL.

Affected products

• Ditec a.s. D.Launcher 2: before 2.0.7 — fixed in 2.0.7

How to fix

Upgrade to a fixed version: Ditec a.s. D.Launcher 2 2.0.7. Check the vendor advisory for mitigations.

References

• https://ditec.sk/static/kep/apps/release-notes/en
• https://www.slovensko.sk/sk/oznamy/detail/_zranitelnost-aplikacie-d-launc

Get alerted when CVE-2026-8993 or the next vulnerability affects your stack