CVE-2026-2999

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2999", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2026-02-23T01:38:30.194Z", "datePublished": "2026-03-02T05:59:35.309Z", "dateUpdated": "2026-03-02T14:09:57.935Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "IDExpert Windows Logon Agent", "vendor": "Changing", "versions": [{"lessThanOrEqual": "2.8.4.250925", "status": "affected", "version": "2.7.3.230719", "versionType": "custom"}]}], "datePublic": "2026-03-02T03:39:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.<br>"}], "value": "IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them."}], "impacts": [{"capecId": "CAPEC-185", "descriptions": [{"lang": "en", "value": "CAPEC-185 Malicious Software Download"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-03-02T05:59:35.309Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-10740-b2eb2-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html"}, {"tags": ["vendor-advisory"], "url": "https://www.changingtec.com/news_detail.jsp?item_id=348"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Contact the vendor to patch or download the patch from the official website.<br>Link\uff1a<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.changingtec.com/news_detail.jsp?item_id=348\">https://www.changingtec.com/news_detail.jsp?item_id=348</a><br>"}], "value": "Contact the vendor to patch or download the patch from the official website.\nLink\uff1a https://www.changingtec.com/news_detail.jsp?item_id=348"}], "source": {"advisory": "TVN-202603001", "discovery": "EXTERNAL"}, "title": "Changing\uff5cIDExpert Windows Logon Agent - Remote Code Execution", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T14:09:28.283807Z", "id": "CVE-2026-2999", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T14:09:57.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T14:09:28.283807Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T14:09:37.668Z"}}], "cna": {"title": "Changing\uff5cIDExpert Windows Logon Agent - Remote Code Execution", "source": {"advisory": "TVN-202603001", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-185", "descriptions": [{"lang": "en", "value": "CAPEC-185 Malicious Software Download"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Changing", "product": "IDExpert Windows Logon Agent", "versions": [{"status": "affected", "version": "2.7.3.230719", "versionType": "custom", "lessThanOrEqual": "2.8.4.250925"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Contact the vendor to patch or download the patch from the official website.\nLink\uff1a https://www.changingtec.com/news_detail.jsp?item_id=348", "supportingMedia": [{"type": "text/html", "value": "Contact the vendor to patch or download the patch from the official website.<br>Link\uff1a<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.changingtec.com/news_detail.jsp?item_id=348\">https://www.changingtec.com/news_detail.jsp?item_id=348</a><br>", "base64": false}]}], "datePublic": "2026-03-02T03:39:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10740-b2eb2-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html", "tags": ["third-party-advisory"]}, {"url": "https://www.changingtec.com/news_detail.jsp?item_id=348", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.", "supportingMedia": [{"type": "text/html", "value": "IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-03-02T05:59:35.309Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2999", "state": "PUBLISHED", "dateUpdated": "2026-03-02T14:09:57.935Z", "dateReserved": "2026-02-23T01:38:30.194Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2026-03-02T05:59:35.309Z", "assignerShortName": "twcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "IDExpert Windows Logon Agent", "vendor": "Changing", "versions": [{"lessThanOrEqual": "2.8.4.250925", "status": "affected", "version": "2.7.3.230719", "versionType": "custom"}]}], "source": "twcert@cert.org.tw"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:changingtec:idexpert:*:*:*:*:*:windows:*:*", "matchCriteriaId": "4B08FDE8-0E08-48B6-875E-C4FEA41454A1", "versionEndIncluding": "2.8.4.250925", "versionStartIncluding": "2.7.3.230719", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them."}, {"lang": "es", "value": "El Agente de Inicio de Sesi\u00f3n de Windows IDExpert desarrollado por Changing tiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo, que permite a atacantes remotos no autenticados forzar al sistema a descargar archivos ejecutables arbitrarios desde una fuente remota y ejecutarlos."}], "id": "CVE-2026-2999", "lastModified": "2026-06-17T10:32:28.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "twcert@cert.org.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2999", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T14:09:28.283807Z", "version": "2.0.3"}}]}, "published": "2026-03-02T07:16:22.743", "references": [{"source": "twcert@cert.org.tw", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.changingtec.com/news_detail.jsp?item_id=348"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-10740-b2eb2-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-494"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.7.3.230719,2.8.4.250925]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "IDExpert Windows Logon Agent", "source": "cna", "vendor": "Changing"}, "product": "idexpert_windows_logon_agent", "vendor": "changing"}], "analysis": {"en": {"generated_at": "2026-04-16T14:40:47.722557+00:00", "value": {"mitigation_remediation": ["Contact Changing to obtain the vendor patch or download the patch from the official website and apply it to all installations of IDExpert Windows Logon Agent.", "If a patch is not yet available, remove or disable the IDExpert Windows Logon Agent from the system to prevent unauthorized remote execution.", "Implement network controls to block or tightly restrict inbound traffic to the agent\u2019s service port, thereby reducing the window for the remote exploitation attempt."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is the IDExpert Windows Logon Agent from Changing. No specific version information was included in the CNA data, so all installed instances of this agent remain potentially vulnerable until a patch is applied.", "description_and_impact": "The vulnerability lies in Changing's IDExpert Windows Logon Agent, where an attacker can force the system to download and execute arbitrary executable files without authentication. This flaw effectively allows remote code execution, a high\u2011severity risk (CWE\u2011494). The impact is immediate compromise of system integrity and confidentiality, as any program can be run with the privileges of the logon agent.", "risk_and_exploitability": "With a CVSS score of 9.3, this flaw is considered critical. The EPSS score of <1% indicates a low current probability of exploitation, yet the lack of constraints on authentication and the ability to download any executable make it a potent threat. The vulnerability is not listed in the KEV catalog, but the potential for remote, unauthenticated attacks warrants high vigilance. An attacker most likely would communicate over the network to the agent\u2019s listening interface, trigger the download routine, and execute the supplied binary."}}}}, "created": "2026-03-03T08:46:03.115308+00:00", "updated": "2026-04-16T14:45:25.976838+00:00", "vendors": ["changing", "changing$PRODUCT$idexpert_windows_logon_agent"]}