Answer in brief
CVE-2026-0392 records a High severity (CVSS 7.3) vulnerability in eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update. The current sources do not mark it as known exploited. The current feed maps Latvijas Valsts radio un televīzijas centrs (LVRTC)/eParakstītājs 3.0 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Latvijas Valsts radio un televīzijas centrs (LVRTC)/eParakstītājs 3.0 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Latvijas Valsts radio un televīzijas centrs (LVRTC)/eParakstītājs 3.0generic | >=0 <1.10.0 | 1.10.0 |
Published upstream
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.
Quoted source text, attributed separately from HOL analysis.