CVE-2026-8931: Disig Web Signer

Critical severity, CVSS 9.4. EPSS: 1% chance of exploitation in the next 30 days.

A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.

Affected products

• Disig Web Signer: from 2.0.3, up to and including 2.5.3

Published 2026-06-01. Last modified 2026-07-22.