The vulnerability CVE-2026-41879 in R-SOFT SERWIS DMS involves the use of a weak cryptographic hash function (non-salted nested MD5) for storing superadmin credentials. This weak hashing allows attackers who gain access to the password hash to decode the superadmin password. Additionally, the password cannot be changed except by editing the configuration file, increasing the risk. The issue was addressed and fixed in version v3.17-2000 of the product.

An attacker who obtains the stored password hash can decode the superadmin credentials due to the weak hashing method. This compromises the highest privilege account in the system. Since the password cannot be changed except by modifying the configuration file, recovery and mitigation are more complex. This elevates the risk of unauthorized full administrative access to the system.

Upgrade to R-SOFT SERWIS DMS version v3.17-2000 or later, where this vulnerability has been fixed. Until the upgrade, restrict access to configuration files and stored password hashes to prevent attackers from obtaining them. There is no official patch or temporary fix other than upgrading to the fixed version.