CVE-2026-8993: D.Launcher 2 SSRF Vulnerability

CVE-2026-8993 Overview

CVE-2026-8993 affects the D.Launcher 2 component of the Slovak eID client ecosystem. The application registers multiple custom URL handlers that improperly process input. Attackers can abuse these handlers to initiate NTLM authentication or Server Message Block (SMB) connections to attacker-controlled infrastructure. The flaw also enables Server-Side Request Forgery (SSRF) attacks against internal resources. Exploitation requires user interaction, as a victim must open a specially crafted URL. The vulnerability is tracked under CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Successful exploitation can leak NTLM credentials to remote attackers and enable SSRF against internal network resources accessible to the victim host.

Affected Products

D.Launcher 2 (Slovak eID client ecosystem component)
Ditec KEP application suite distributing D.Launcher 2
Endpoints with custom URL handlers registered by D.Launcher 2

Discovery Timeline

2026-06-02 - CVE-2026-8993 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-8993

Vulnerability Analysis

D.Launcher 2 registers multiple custom Uniform Resource Identifier (URI) schemes during installation. These handlers accept parameters from the invoking browser or operating system shell. The application fails to validate or sanitize URL parameters before passing them to downstream network functions.

An attacker hosts a page containing a crafted URI that targets one of the registered schemes. When a victim clicks the link, the operating system invokes D.Launcher 2 with attacker-controlled arguments. The application then issues outbound network requests to the host specified in the URL.

If the destination is a Server Message Block (SMB) endpoint controlled by the attacker, Windows automatically transmits NTLM authentication material. The same primitive permits SSRF against internal HTTP endpoints reachable from the victim machine.

Root Cause

The root cause is improper URL handler processing in registered custom protocol handlers. D.Launcher 2 treats URL parameters as trusted network destinations. No allow-listing of hosts, schemes, or ports is performed before initiating outbound connections.

Attack Vector

The attack vector is network-based with required user interaction. An attacker delivers a crafted URL through phishing email, instant messaging, or a malicious web page. Opening the URL triggers the vulnerable handler and produces an outbound connection to attacker infrastructure or to internal services normally shielded from external access. The vulnerability impacts confidentiality through credential disclosure and information leakage from internal resources.

No verified proof-of-concept code is published. See the Slovensko Vulnerability Announcement for vendor technical details.

Detection Methods for CVE-2026-8993

Indicators of Compromise

Outbound SMB (TCP/445) or NTLM authentication attempts originating from workstations running D.Launcher 2 toward untrusted external hosts.
Browser process spawning D.Launcher 2 with arguments containing UNC paths (\\attacker\share) or non-standard URL schemes.
HTTP requests from D.Launcher 2 to internal-only endpoints not associated with normal eID workflows.

Detection Strategies

Inspect endpoint process telemetry for D.Launcher 2 invocations triggered by browser parent processes with suspicious command-line URLs.
Correlate registry events that read custom URL handler keys with subsequent outbound network connections to external IP space.
Hunt for NTLM authentication failures and successes against hosts outside the corporate domain perimeter.

Monitoring Recommendations

Enable Windows Security event logging for outbound NTLM and forward Microsoft-Windows-NTLM/Operational events to a central log store.
Monitor egress traffic on TCP/139 and TCP/445 at the network perimeter and alert on any connections from user workstations.
Track creation and modification of HKEY_CLASSES_ROOT URL handler entries associated with D.Launcher 2.

How to Mitigate CVE-2026-8993

Immediate Actions Required

Update D.Launcher 2 to the latest version published by Ditec. Consult the Ditec Release Notes for the fixed build.
Block outbound TCP/139 and TCP/445 at the network perimeter to prevent NTLM credential theft over SMB.
Restrict outbound HTTP requests from the D.Launcher 2 process to known eID service endpoints only.

Patch Information

Ditec has published updated builds of D.Launcher 2 addressing the improper URL handler processing. Deploy the fixed version distributed through the official Ditec channel referenced in the Ditec Release Notes and the Slovensko Vulnerability Announcement.

Workarounds

Unregister the affected custom URL handlers until the patched version is deployed if D.Launcher 2 is not actively required.
Configure Group Policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all for high-risk user groups.
Train users to avoid clicking unsolicited links that invoke desktop applications through custom URI schemes.

bash

# Group Policy registry setting to deny outgoing NTLM to remote servers
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f