CERT Polska: three flaws in ZUS's Płatnik contributions software

CERT Polska: three flaws in ZUS's Płatnik contributions software

30 October 2026: CERT Polska has published three vulnerabilities in Płatnik, the desktop program Polish employers, payroll offices and accountants use to prepare and send social insurance declarations to ZUS, the national social insurance institution. All versions before metric 334 of version 10.02.002 are affected; the advisory of 30 October was updated on 3 November to correct the metric number of the fix.

Not yet independently verified. The advisory comes from CERT Polska, which coordinated the disclosure; we did not find a ZUS release note, and the advisory gives no CVSS scores and no statement on exploitation. We will update this when it can be confirmed, and remove this note.

Three flaws in one program

• CVE-2026-110970: Płatnik downloaded updates, libraries and support files over unencrypted HTTP, so an attacker in a position to intercept traffic could read the data and replace the files with their own (CWE-1428). Grzegorz Sawicki reported it.
• CVE-2026-110971: passwords were encoded weakly, so a user who obtained an encoded password could easily decode it (CWE-261).
• CVE-2026-110972: authentication happened on the client. An attacker with access to any Płatnik instance connected to the backend server could bypass the login check and authenticate as an arbitrary user (CWE-603).

Wojciech Giełda reported the second and third flaws. CERT Polska says all three are fixed in metric 334 of version 10.02.002.

Why the login bypass matters most

Płatnik is often installed in shared setups: an accounting firm or a payroll department runs several workstations against one database server holding declarations for many payers. In that arrangement the third flaw means anyone who can use one workstation can act as any other user, with that user's access to employees' PESEL numbers, salaries and contribution data. The first flaw adds a supply-chain risk for offices on untrusted networks, since an intercepted update could install whatever an attacker chose.

Updating payroll workstations

Payroll and HR teams should:

• check the version and metric shown in Płatnik on every workstation and on the server installation, and update to 10.02.002 metric 334 or later;
• run updates only from a trusted network until every machine is patched;
• change Płatnik passwords after updating, since any encoded passwords copied before the fix can be decoded;
• review which staff can reach the Płatnik database server, because access to one connected instance was enough for the bypass.

Our catalogue lists 13 payroll software products.

Related on TrustList:

• Fifteen employment rule changes in nine countries this autumn
• Upwork's Lifted buys Berlin employer of record WorkMotion

Sources

• CERT Polska: vulnerabilities in Płatnik software (CVE-2026-110970 to CVE-2026-110972), 30 October 2026