CVE-2026-2999

Executive Summary

CVE-2026-2999 is a critical Remote Code Execution (RCE) vulnerability in the IDExpert Windows Logon Agent developed by Changing (Changingtec). The vulnerability permits unauthenticated remote attackers to coerce the affected system into downloading and executing arbitrary executable files from a remote source, providing full system compromise with no authentication required. With a CVSS score of 9.3, any organization deploying the IDExpert Windows Logon Agent in an internet-facing or untrusted network segment is at immediate risk of complete compromise. Credential storage and authentication enforcement components within enterprise environments make this a high-priority patching target despite the low EPSS score (0.00508) and lack of CISA KEV listing.

Technical Analysis

The NVD description identifies CVE-2026-2999 as a Remote Code Execution vulnerability within the IDExpert Windows Logon Agent produced by Changing. The core mechanism permits unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and subsequently execute them. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) as inferred from the vulnerability class, though NVD lists the CWE as UNKNOWN.

The attack surface is the IDExpert Windows Logon Agent, a component designed to integrate with Windows authentication workflows, typically deployed on domain-joined endpoints or authentication gateways. The agent presumably listens on a network port or processes inbound requests as part of its logon credential verification flow. The flaw mechanism, based on the vulnerability class, involves insufficient validation of remote content before the agent fetches and executes it — effectively an arbitrary file download and execution primitive accessible without authentication.

Technical specifics regarding the exact protocol, port, function names, or code paths are not disclosed in the NVD description or CNA title. No function names, endpoints, or file paths are available to enumerate. The vulnerability class suggests that either (a) the agent accepts a URL or download instruction from an unauthenticated network request and fetches the content with insufficient trust boundaries, resulting in execution with the privileges of the agent process (likely SYSTEM), or (b) the agent fails to restrict which remote sources are permitted for updates or auxiliary payloads, allowing a man-in-the-middle or direct network attacker to substitute malicious executables. Insufficient technical detail is available in the public disclosure to determine which specific implementation pattern applies.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms the worst-case scenario: network-accessible, low attack complexity, no privileges required, no user interaction, with scope change indicating the compromise extends beyond the vulnerable component. The EPSS score of 0.00508 (40.6th percentile) indicates low current exploitation probability, but this metric reflects known exploitation activity, not intrinsic severity.

Exploitation Scenarios

Attack chain for CVE-2026-2999, inferred strictly from the NVD description and vulnerability class:

1. Reconnaissance/Target Identification: The attacker scans for systems running the IDExpert Windows Logon Agent. Since the agent integrates with Windows logon flows, discovery may occur through network scanning for the agent's listening port, banner grabbing, or identifying related authentication service responses. Affected systems are Windows endpoints or servers with the agent installed, particularly those in the authentication path for enterprise identity management.

2. Vulnerability Trigger: The attacker sends a crafted network request to the agent's exposed service. Per the NVD description, this request can be performed by an unauthenticated remote attacker. Based on the vulnerability class (CWE-434), the request likely instructs the agent to fetch content from an attacker-controlled remote source — either by providing a URL directly or by exploiting a flaw in how the agent handles update or configuration payloads. The exact request format is not publicly documented; insufficient technical detail is available to specify the precise trigger condition.

3. Payload Delivery and Execution: The attacker hosts a malicious executable (e.g., a reverse shell, C2 beacon, or privilege escalation tool) on an HTTP/HTTPS/FTP server under their control. The vulnerable agent, upon processing the malicious request, downloads this file from the remote source and executes it. Because the agent runs in the Windows logon context, execution likely occurs with elevated privileges — potentially SYSTEM or at minimum with the credentials of the authentication service account. No user interaction is required, per the UI:N component of the CVSS vector.

4. Post-Exploitation Impact: Achieving code execution on the compromised host grants the attacker a foothold in the enterprise environment. Since the agent is part of the logon/authentication infrastructure, the attacker may be able to extract cached credentials, intercept authentication traffic, or pivot to other systems. The scope change (S:C) indicates the attacker can affect resources beyond the vulnerable component — in this case, the broader domain or identity infrastructure. Lateral movement, credential harvesting, and ransomware deployment are all plausible follow-on activities.

Note: No public PoC is available, and no exploit code has been disclosed. The attack chain is inferred from the vulnerability class and NVD description. The lack of a public PoC does not diminish the risk — the CVSS score of 9.3 reflects the severity of a flaw requiring only network access and no authentication.

Impact Assessment

The business impact of CVE-2026-2999 is severe for any organization deploying the IDExpert Windows Logon Agent. The following dimensions are affected:

• Confidentiality (High): Successful exploitation grants code execution, allowing attackers to read sensitive data from the compromised host — credential stores, configuration files, and any data accessible to the agent's privileges.
• Integrity (High): Attackers can modify system files, install persistence mechanisms, tamper with authentication logic, or deploy additional malware.
• Availability (High): Full system compromise enables denial-of-service through destructive actions, ransomware deployment, or system re-imaging.
• Scope (Changed): The compromise extends beyond the vulnerable agent. If the agent participates in domain authentication, attackers may leverage the compromised context to access domain controllers, other endpoints, or backend identity services.

The affected population includes all versions of the IDExpert Windows Logon Agent for which a patch is not yet applied. No specific affected version range is documented. The vendor (Changing/Changingtec) has published a patch advisory, but patch confidence is 2/4 (CLAIMED) — only a single source (the CNA) asserts that a patch exists, and it has not been independently confirmed.

The blast radius is particularly significant in environments where the agent is deployed on internet-facing systems or in demilitarized zones, as the unauthenticated remote attack vector (AV:N) makes external exploitation feasible. However, even in internal deployments, a compromised endpoint in the authentication path creates a high-value target for lateral movement.

Detection Guidance

The following detection rules are proposed to identify exploitation attempts and post-exploitation activity associated with CVE-2026-2999. These rules focus on the observable behaviors implied by the vulnerability: outbound downloads of executables followed by process execution, and anomalous network connections to the agent's service.

Sigma Rule

title: Suspicious Executable Download and Execution via IDExpert Logon Agent
id: cve-2026-2999-idagent-rce
status: experimental
description: Detects download of executable files followed by process execution, potentially indicating exploitation of CVE-2026-2999 in the IDExpert Windows Logon Agent.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2999
tags:
    - attack.execution
    - attack.command_and_control
    - attack.t1105
    - cve.2026.2999
logsource:
    category: process_creation
    product: windows
detection:
    selection_download:
        EventID: 1
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IWR'
            - 'curl'
            - 'wget'
            - 'certutil'
            - 'bitsadmin'
            - 'Start-BitsTransfer'
    selection_network:
        # Network connections where source process connects to remote host
        # Assuming Sysmon EventID 3 or Windows Defender Firewall logs
        # Placeholder for log source - adjust per environment
        DestinationPort: 80
        or DestinationPort: 443
    condition: selection_download
    timeframe: 5m
level: high
falsepositives:
    - Legitimate software updates in enterprises
    - Admin running standard troubleshooting tools

YARA Rule

rule CVE_2026_2999_IDExpert_LogonAgent_RCE
{
    meta:
        author = "ValtersIt Threat Intelligence"
        description = "Detects suspicious executables or scripts that may be delivered via CVE-2026-2999 exploitation"
        reference = "CVE-2026-2999"
        date = "2026-02-01"
        severity = "critical"
        cve = "CVE-2026-2999"
    strings:
        $s1 = "IDExpert" nocase
        $s2 = "LogonAgent" nocase
        $s3 = "Changing" nocase
        $s4 = "http://" nocase
        $s5 = "https://" nocase
        $s6 = "download" nocase
        $s7 = "execute" nocase
        $s8 = "invoke" nocase
        // Sequence: identifier strings often appear in config or command strings
    condition:
        uint16(0) == 0x5A4D and  // MZ header (PE executable)
        (any of ($s1, $s2, $s3) or
         (any of ($s4, $s5, $s6) and any of ($s7, $s8)))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-2999 IDExpert Logon Agent RCE - Potential Exploitation Attempt"; flow:to_server,established; content:"GET"; http_method; http.uri; content:"exe"; http.uri; pcre:"/(\.exe|\.dll|\.ps1|\.bat|\.cmd)(\?|$)/i"; reference:cve,2026-2999; classtype:attempted-admin; sid:20262999; rev:1;)

Elastic Detection

// EQL query to detect process execution following suspicious file downloads
sequence by host.name with maxspan=5m
  [ network where
      process.name : ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "certutil.exe", "bitsadmin.exe") and
      destination.port : (80, 443, 8080, 8443) and
      network.direction : ("egress", "outbound")
  ]
  [ process where
      event.action == "start" and
      process.parent.name : ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "certutil.exe", "bitsadmin.exe") and
      process.executable : ("*.exe", "*.dll", "*.bat", "*.cmd", "*.scr")
  ]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=wineventlog
| where EventCode=4688 OR EventCode=1
| search CommandLine IN ("*Invoke-WebRequest*", "*IWR*", "*curl*", "*wget*", "*certutil*", "*bitsadmin*", "*Start-BitsTransfer*", "*downloadstring*")
| table _time, host, User, New_Process_Name, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="cve-2026-2999,rce,">
  <rule id="126049" level="12">
    <if_sid>5000000</if_sid>
    <match>Invoke-WebRequest|IWR|curl|wget|certutil|bitsadmin|Start-BitsTransfer</match>
    <description>CVE-2026-2999: Potential exploitation attempt - suspicious download command detected</description>
    <group>attack.t1105,</group>
    <mitre>
      <id>T1105</id>
    </mitre>
  </rule>
  <rule id="126050" level="14">
    <if_sid>20262999</if_sid>
    <match>exe|dll|ps1|bat|cmd</match>
    <description>CVE-2026-2999: Suspicious download followed by executable file execution - high confidence exploitation</description>
    <group>attack.t1105,attack.execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-2999 is 2/4 (CLAIMED). The CNA asserts that a patch exists and directs users to the vendor advisory at https://www.changingtec.com/news_detail.jsp?item_id=348. However, this has not been independently confirmed; analysts should verify patch availability and integrity before deployment.

1. Immediate Mitigations (no patch verification yet)

• Network Segmentation: If the IDExpert Windows Logon Agent is not required to accept remote network connections, restrict access to the agent's listening service via host-based firewall rules. Block inbound connections from untrusted networks (e.g., the internet) to the affected system.
• Access Control Lists: Apply network ACLs on perimeter and internal firewalls to restrict access to the agent's management or communication ports to only known administrative hosts or trusted IP ranges.
• Monitor Outbound Traffic: Enable enhanced logging on endpoints running the agent, particularly for outbound HTTP/HTTPS traffic and process creation events. Alert on any unexpected executable downloads or new process spawns from the agent's process context.
• Temporary Service Deactivation: If feasible and business-impact-acceptable, disable the logon agent service or its network-facing functionality until the patch is confirmed and applied.
• Credentials Rotation: As a precaution if exploitation is suspected, rotate credentials for service accounts used by the agent and any cached credentials on potentially affected hosts.

2. Patch/Upgrade Steps

• Verify Patch Advisory: Review the vendor advisory at https://www.changingtec.com/news_detail.jsp?item_id=348 to confirm the patch exists, identify the patched version number, and read the vendor's patch notes.
• Patch Installation: Download the patch from the official Changing website and test in a staging environment before production deployment. Validate that the patch is digitally signed by the vendor.
• Version Confirmation: After patching, verify the agent version is updated to the patched build and that the vulnerability is no longer exploitable (e.g., via a controlled test against a non-production replica).
• Independent Confirmation: Given the 2/4 patch confidence, attempt to contact the vendor directly through official support channels to confirm the patch's authenticity and request additional technical details on the vulnerability.

3. Long-Term Hardening

• Vendor Communication: Establish a direct channel with Changing's security contact to receive future vulnerability disclosures and patch notifications promptly.
• Patch Management Lifecycle: Ensure IDExpert Windows Logon Agent is included in enterprise patch management and asset inventory systems, with a formal patch testing and deployment SLA.
• Defense in Depth: Deploy the agent on hosts with endpoint detection and response (EDR) solutions capable of detecting and blocking arbitrary executable downloads and executions.
• Least Privilege: Where feasible, run the logon agent with the lowest privilege necessary to fulfill its function, reducing the impact of any future RCE.
• Incident Response Preparedness: Include CVE-2026-2999 in threat hunting playbooks and ensure detection rules from the Detection Guidance section are deployed and tested.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-2999 — Official NVD vulnerability record with CVSS score and description.
2. Vendor Advisory: https://www.changingtec.com/news_detail.jsp?item_id=348 — Changing's official advisory acknowledging the vulnerability and providing patch download instructions.
3. CWE-434 Reference: https://cwe.mitre.org/data/definitions/434.html — Unrestricted Upload of File with Dangerous Type, the inferred vulnerability class.
4. MITRE ATT&CK — T1105: https://attack.mitre.org/techniques/T1105/ — Ingress Tool Transfer, the technique that best characterizes the download-and-execute attack mechanism.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-2999 is NOT currently listed in the CISA KEV catalog, indicating no confirmed in-the-wild exploitation as of this report.

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to CVE-2026-2999 as of the report date. The EPSS score of 0.00508 (40.6th percentile) indicates low observed exploitation activity in the wild. No exploit code has been publicly released despite the PoC status being marked as "Public" on some aggregated sources; however, no functional exploit code or Nuclei template has been confirmed. Analysts should treat this vulnerability with high priority due to the criticality of the authentication infrastructure it affects, regardless of current threat actor adoption.