CVE-2026-23746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23746", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-15T18:42:20.937Z", "datePublished": "2026-01-15T19:44:53.716Z", "dateUpdated": "2026-05-14T02:09:22.133Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Instant Financial Issuance (IF)", "vendor": "Entrust Corporation", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "6.10.5", "status": "affected", "version": "6.0", "versionType": "custom"}, {"lessThan": "6.11.1", "status": "affected", "version": "6.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host."}], "value": "Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:09:22.133Z"}, "references": [{"tags": ["product"], "url": "https://www.entrust.com/products/issuance-systems/instant/financial-card"}, {"tags": ["vendor-advisory", "patch"], "url": "https://trustedcare.entrust.com/s/article/E26-001-NET-Remoting-Vulnerabilities-in-the-Smart-Card-Controller-Service-of-the-Instant-Financial-Issuance-On-Premise-Software"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/entrust-ifi-smartcardcontroller-service-net-remoting-rce"}], "source": {"discovery": "UNKNOWN"}, "title": "Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T20:33:16.747301Z", "id": "CVE-2026-23746", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T20:33:58.351Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-15T20:33:16.747301Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T20:33:47.242Z"}}], "cna": {"title": "Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Entrust Corporation", "product": "Instant Financial Issuance (IF)", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "6.0", "lessThan": "6.10.5", "versionType": "custom"}, {"status": "affected", "version": "6.0", "lessThan": "6.11.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.entrust.com/products/issuance-systems/instant/financial-card", "tags": ["product"]}, {"url": "https://trustedcare.entrust.com/s/article/E26-001-NET-Remoting-Vulnerabilities-in-the-Smart-Card-Controller-Service-of-the-Instant-Financial-Issuance-On-Premise-Software", "tags": ["vendor-advisory", "patch"]}, {"url": "https://www.vulncheck.com/advisories/entrust-ifi-smartcardcontroller-service-net-remoting-rce", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.", "supportingMedia": [{"type": "text/html", "value": "Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:09:22.133Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23746", "state": "PUBLISHED", "dateUpdated": "2026-05-14T02:09:22.133Z", "dateReserved": "2026-01-15T18:42:20.937Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-15T19:44:53.716Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Instant Financial Issuance (IF)", "vendor": "Entrust Corporation", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "6.10.5", "status": "affected", "version": "6.0", "versionType": "custom"}, {"lessThan": "6.11.1", "status": "affected", "version": "6.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host."}, {"lang": "es", "value": "El software Entrust Instant Financial Issuance (IFI) On Premise (anteriormente conocido como CardWizard) versiones 5.x, anteriores a la 6.10.5, y anteriores a la 6.11.1 contienen una exposici\u00f3n insegura de .NET Remoting en el servicio SmartCardController (DCG.SmartCardControllerService.exe). El servicio registra un canal de remoting TCP con un formateador/configuraci\u00f3n inseguros que permiten la invocaci\u00f3n de objetos de remoting no confiables. Un atacante remoto no autenticado que pueda alcanzar el puerto de remoting puede invocar objetos de remoting expuestos para leer archivos arbitrarios del servidor y forzar la autenticaci\u00f3n saliente, y puede lograr la escritura arbitraria de archivos y la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de t\u00e9cnicas conocidas de explotaci\u00f3n de .NET Remoting. Esto puede llevar a la divulgaci\u00f3n de datos sensibles de instalaci\u00f3n y de cuentas de servicio y al compromiso del host afectado."}], "id": "CVE-2026-23746", "lastModified": "2026-06-17T10:22:02.380", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23746", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T20:33:16.747301Z", "version": "2.0.3"}}]}, "published": "2026-01-15T20:16:05.917", "references": [{"source": "disclosure@vulncheck.com", "url": "https://trustedcare.entrust.com/s/article/E26-001-NET-Remoting-Vulnerabilities-in-the-Smart-Card-Controller-Service-of-the-Instant-Financial-Issuance-On-Premise-Software"}, {"source": "disclosure@vulncheck.com", "url": "https://www.entrust.com/products/issuance-systems/instant/financial-card"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/entrust-ifi-smartcardcontroller-service-net-remoting-rce"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-502"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:57:26.578454+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Instant Financial Issuance version (6.10.5 or newer) which removes the insecure remoting channel.", "If an upgrade is not immediately possible, disable or stop the SmartCardController service (DCG.SmartCardControllerService.exe) to prevent the vulnerable remoting endpoint from listening.", "Block inbound traffic to the affected remoting port at the network perimeter using firewall rules, limiting access to trusted administrators only.", "Apply any vendor\u2011issued hotfixes or workarounds published in the official advisory."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected software is Entrust Corporation's Instant Financial Issuance (IF) On-Premise product, including all 5.x releases, and 6.x releases prior to 6.10.5 and prior to 6.11.1. The vulnerable component is DCG.SmartCardControllerService.exe, which registers a TCP remoting channel.", "description_and_impact": "The vulnerability arises from the SmartCardController service in Entrust Instant Financial Issuance that exposes a .NET Remoting channel with unsafe formatter settings, allowing unauthenticated callers to invoke remote objects. An attacker can read arbitrary files, force outbound authentication, and potentially write files or execute code, leading to disclosure of installation secrets and complete compromise of the affected host. The weakness is reflected in CWE-306 for improper authentication and CWE-502 for deserialization of untrusted data.", "risk_and_exploitability": "The CVSS v3.1 base score of 9.3 indicates critical severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is network-based: an unauthenticated remote actor must be able to reach the remoting port to trigger the exploit, which could be mitigated by firewall rules. The involvement of unsafe serialization and lack of authentication allows for remote code execution once access is established."}}}}, "created": "2026-01-16T13:42:56.011074+00:00", "updated": "2026-04-16T08:00:11.206873+00:00", "vendors": ["entrust", "entrust$PRODUCT$instant_financial_issuance", "entrust_instant_financial_issuance", "entrust_instant_financial_issuance$PRODUCT$entrust_instant_financial_issuance"]}