CVE-2026-8931: Critical RCE vulnerability in Disig Web Signer

Synopsis

A remote code execution vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3. The vulnerability is reachable over the network, requires no authentication, and is triggered when a user interacts with attacker-controlled content, based on the CVSS v4.0 vector. Successful exploitation gives the attacker full code execution on the host, with high-impact compromise across confidentiality, integrity, and availability for both the vulnerable component and any systems it can reach. A patched-image rebuild at version 2.5.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable service over the network; no local or physical access is required.

• AuthenticationNot required

  No account or credentials of any privilege level are needed to initiate the attack.

• Victim interactionRequired

  A user must interact with attacker-controlled content (for example, opening a crafted document or visiting a malicious page) to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Reads any files or secrets accessible to the Web Signer process, including private keys used for document signing.
• Writes or modifies files and data on the host, enabling persistence, credential theft, or tampering with signed documents.
• Crashes or fully disrupts the Web Signer service, blocking signing operations for any dependent workflows.
• Because both system (SC/SI/SA) scores are High, a successful attacker can pivot to connected systems or services that trust the compromised host, extending the impact beyond the Web Signer process itself.