CVE-2026-0872

Executive Summary

CVE-2026-0872 is a low-severity improper certificate validation vulnerability in Thales SafeNet Agent for Windows Logon, a certificate-based authentication client used for smartcard and PKI logon on Windows endpoints. The flaw affects versions 4.0.0, 4.1.1, and 4.1.2, and enables signature spoofing through improper certificate validation, potentially permitting an attacker to forge trusted identities. With a CVSS score of 2.5 and no confirmed exploitation in the wild, the immediate risk is low but non-zero, particularly in high-trust PKI environments where certificate authentication is the primary access control.

Technical Analysis

Thales SafeNet Agent for Windows Logon is a middleware component that integrates smartcard and certificate-based authentication into the Windows logon process (winlogon), handling the cryptographic verification of user certificates against enterprise PKI trust chains. The vulnerability resides in the certificate validation routine — specifically in how the agent verifies the signature chain of certificates presented during interactive or network logon.

The improper certificate validation allows a signature spoofing scenario: if an attacker can present a certificate with a malformed or re-signed signature block that fails standard X.509 path validation but passes the agent's weakened checks, the agent may accept the certificate as authoritative. This is a classic "improper validation" weakness (mapped loosely to the CWE-295 family — Improper Certificate Validation), where the trust decision is made without cryptographically binding the presented key material to a trusted root in the expected manner.

Attack surface analysis: The vulnerable code path is reachable whenever the SafeNet Agent processes a certificate during Windows logon — either at the interactive login screen, during smartcard insertion/removal events, or via RDP/network logon where certificate-based authentication is configured. The agent runs with SYSTEM privileges within the winlogon context, so any successful signature spoofing would result in an authentication bypass — an attacker-signed or attacker-crafted certificate being treated as a legitimate domain or local credential.

The precise flawed code is not publicly documented, but the vulnerability class suggests the agent relies on a custom certificate trust store or fails to call the Windows CryptoAPI CertGetCertificateChain with the appropriate validation flags, or skips revocation checking and basic constraint verification. The absence of CISA KEV listing and low EPSS percentile (0.00183) indicate this is not an actively weaponized flaw.

Exploitation Scenarios

Despite the absence of a public PoC, the following attack chain demonstrates how this vulnerability would be exploited in a realistic environment.

Step 1 — Reconnaissance/Target Identification. The attacker identifies a target environment using Thales SafeNet Agent for Windows Logon. This is accomplished via network scanning for Windows endpoints with the agent service running (checking for the SafeNetAgentService process or the Thales directory C:\Program Files\Thales\SafeNet Agent\), or via active directory enumeration where the agent version is discoverable through software inventory policies. Social engineering can also be used to plant a malicious smartcard or USB token.

Step 2 — Crafting the Malicious Certificate. The attacker generates a certificate using OpenSSL with the following steps: create a self-signed CA certificate, then issue a client authentication certificate signed by that rogue CA. The attacker then corrupts or strips the signature algorithm identifier in the certificate's TBSCertificate structure — e.g., altering the signatureAlgorithm OID from sha256WithRSAEncryption to sha1WithRSAEncryption while keeping the actual SHA-256 signature — causing the SafeNet Agent's validation routine to misparse the certificate chain.

Step 3 — Trigger/Weaponization. The attacker presents the crafted certificate during the Windows logon process. If physical access is available, the attacker inserts the smartcard or certificates into the target endpoint and selects the certificate at the logon screen. If remote access is the vector, the attacker uses the certificate in a network logon attempt (e.g., via Remote Desktop Protocol with smartcard authentication enabled, or through a crafted certificate request to a service relying on the SafeNet Agent's validation). The agent validates the certificate chain, which improperly accepts the malformed signature block as legitimate due to the validation flaw, and proceeds to authenticate the user.

Step 4 — Payload/Execution. Upon successful certificate validation, the Windows logon proceeds, granting the attacker an interactive session with the privileges associated with the forged certificate's subject — typically a domain user or a local administrative user if the attacker chose that subject DN.

Step 5 — Post-Exploitation Impact. With an authenticated session, the attacker can move laterally across the domain (mimikatz for credential dumping, RDP for lateral movement), elevate privileges using the new identity, or exfiltrate sensitive data. Because the certificate appears valid, the attack may evade security monitoring that trusts certificate-based authentication as inherently safe.

Impact Assessment

Business Impact: The vulnerability undermines the trust anchor for certificate-based authentication. In regulated industries (finance, healthcare, government) relying on SafeNet Agent for smartcard logon to meet compliance mandates (e.g., HSPD-12, PCI-DSS MFA), a signature spoofing flaw could allow unauthorized access with forged identities, potentially resulting in regulatory non-compliance findings.

Affected Systems: All Windows endpoints, servers, and workstations running SafeNet Agent for Windows Logon versions 4.0.0, 4.1.1, and 4.1.2. This includes environments where smartcard/PKI logon is enforced for privileged access management or for all employees.

Blast Radius: CVSS 2.5 (Low) reflects the low attack complexity requirement (attacker must craft a specific certificate and have a presentation vector) and low likelihood. However, the confidentiality and integrity impact are locally high post-exploitation. The 8.1% EPSS percentile indicates low exploitation likelihood in the near term.

Detection Guidance

Sigma Rule

title: Thales SafeNet Agent - Unusual Certificate Validation Event
id: 895f8c7a-4e42-4f1a-9b3a-11c4d2e6f8a1
status: experimental
description: Detects certificate validation failures or errors in Thales SafeNet Agent for Windows Logon that may indicate CVE-2026-0872 exploitation attempts.
author: Valtersit Threat Intel
date: 2026/01/15
logsource:
    product: windows
    service: security
    category: authentication
detection:
    selection:
        EventID:
            - 4624   # Logon
            - 4768   # Kerberos TGT
            - 4769   # Kerberos Service Ticket
        LogonType:
            - 3      # Network
            - 8      # NetworkCleartext
            - 9      # NewCredentials
        LogonProcessName: User32
        AuthenticationPackageName: Negotiate
    selection_safenet:
        cert_validation_error:
            - '0x800B0109'  # CERT_E_UNTRUSTEDROOT
            - '0x800B0104'  # CERT_E_CHAINING
    condition: selection and selection_safenet
falsepositives:
    - Legitimate certificate renewal failures
    - PKI misconfiguration events
level: medium
tags:
    - attack.t1554
    - attack.t1649
    - cve.2026-0872

YARA Rule

rule Detect_SafeNetAgent_CertValidationFlaw
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious certificate files (PEM/DER) crafted to exploit CVE-2026-0872 with modified signatureAlgorithm OID"
        cve = "CVE-2026-0872"
        date = "2026-01-15"
        severity = "low"
    strings:
        $sigalg_sha256 = "sha256WithRSAEncryption"
        $sigalg_sha1   = "sha1WithRSAEncryption"
        $thales_path   = "SafeNet Agent"
        $cert_oid      = { 06 09 2a 86 48 86 f7 0d 01 01 0b } // SHA256 OID
        $cert_oid_sha1 = { 06 09 2a 86 48 86 f7 0d 01 01 05 } // SHA1 OID
    condition:
        uint16(0) == 0x3082 and // DER SEQUENCE
        any of ($cert_oid*) and
        (#sigalg_sha256 > 0 or #sigalg_sha1 > 0) and
        filesize > 512
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-0872 - Thales SafeNet Agent Malformed Certificate Detection"; flow:established,to_server; content:"|30 82|"; depth:2; content:"|06 09 2a 86 48 86 f7 0d 01 01 05|"; distance:0; within:256; content:"|06 09 2a 86 48 86 f7 0d 01 01 0b|"; distance:0; within:512; reference:cve,2026-0872; classtype:attempted-user; sid:1000872; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ authentication where event.outcome == "failure"
    and winlog.event_id == 4625
    and winlog.provider_name == "Microsoft-Windows-Security-Auditing"
    and winlog.event_data.SubStatus == "0xC00001A4" ]
  [ authentication where event.outcome == "success"
    and winlog.event_id == 4624
    and winlog.event_data.AuthenticationPackageName == "Negotiate"
    and stringContains(winlog.event_data.WorkstationName, "-WS-") ]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| eval cert_status = case(ErrorCode=="0x800B0109", "untrustedroot", ErrorCode=="0x800B0104", "chaining_error")
| where ErrorCode == "0x800B0109" OR ErrorCode == "0x800B0104"
| table _time, host, Account_Name, Logon_Type, Process_Name, subject, issuer, cert_status
| stats count by host, Account_Name, cert_status
| where count > 5

Wazuh OSSEC Rule

<group name="thales_safenet,">
    <rule id="100872" level="8">
        <if_sid>550</if_sid>
        <match>SafeNet Agent</match>
        <regex>Certificate validation failed|Error 0x800B0109|Error 0x800B0104</regex>
        <description>Possible CVE-2026-0872 exploitation: SafeNet Agent certificate validation error detected.</description>
        <group>authentication_failure,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations:

   • Apply the vendor patch: Upgrade SafeNet Agent for Windows Logon to version 4.1.3, which is claimed by the CNA to resolve this issue. Validate the update in a test environment before production rollout.
   • Restrict certificate logon: Temporarily disable certificate-based Windows logon in favor of password-based authentication if the patched version cannot be deployed immediately.
   • Tighten certificate trust: Implement additional access control policies in Group Policy to require certificate trust chain validation against a specific internal root CA, rejecting third-party or self-signed CAs.

2. Patch/Upgrade Steps:

   • Download version 4.1.3 from the Thales SafeNet support portal.
   • Run the installer with administrative privileges on all affected endpoints; this typically requires a reboot.
   • For bulk deployment, use enterprise software management tools (SCCM, Intune) to stage and roll out the update.
   • Verify the installed version post-upgrade via wmic product where "Name like '%SafeNet Agent%'" get Version.

3. Long-Term Hardening:

   • Enable full chain validation: Ensure the SafeNet Agent is configured to use the Windows certificate store and enforce revocation checking (CRL/OCSP) in production settings.
   • Monitor vendor advisories: Thales publishes security bulletins; subscribe to their advisory feed to track future vulnerabilities in the SafeNet Agent product line.
   • Baseline activity logging: Enable rich security auditing (Subcategory 4624/4625, smartcard events) for all endpoints using certificate logon.
   • Network segmentation: Isolate sensitive PKI environments from general user networks to limit the blast radius of any future certificate spoofing events.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0872 — NVD record with CVSS 2.5 and affected versions (4.0.0, 4.1.1, 4.1.2).
2. Thales / CNA Advisory: Vendor advisory (referenced via CNA PSIRT) confirming vulnerability in SafeNet Agent for Windows Logon, recommending upgrade to version 4.1.3.
3. MITRE ATT&CK — Credential Access: https://attack.mitre.org/tactics/TA0006/ — Relevant framework for certificate-based authentication attacks.
4. NIST OWASP Certificate Validation Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html — General guidance on certificate validation weaknesses.
5. EPSS Data Source: https://www.first.org/epss/ — EPSS score 0.00183 (8.1% percentile) — probability of exploitation in the wild remains low.

No known threat actor campaigns have been publicly attributed to CVE-2026-0872, and it is not in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.