CVE-2026-23746: Entrust IFI .NET Remoting RCE Flaw

CVE-2026-23746 Overview

CVE-2026-23746 is a critical remote code execution vulnerability affecting Entrust Instant Financial Issuance (IFI) On Premise software, formerly known as CardWizard. The vulnerability exists in the SmartCardController service (DCG.SmartCardControllerService.exe), which registers a TCP remoting channel with unsafe formatter and configuration settings that permit untrusted remoting object invocation. This insecure .NET Remoting exposure allows remote, unauthenticated attackers to invoke exposed remoting objects, enabling arbitrary file read operations, outbound authentication coercion, and potentially arbitrary file write and remote code execution through well-known .NET Remoting exploitation techniques.

Critical Impact

This vulnerability enables unauthenticated remote attackers to achieve full system compromise through arbitrary file operations and remote code execution, potentially exposing sensitive financial card issuance data and service account credentials.

Affected Products

• Entrust Instant Financial Issuance (IFI) On Premise software versions 5.x
• Entrust IFI On Premise versions prior to 6.10.5
• Entrust IFI On Premise versions prior to 6.11.1

Discovery Timeline

• 2026-01-15 - CVE CVE-2026-23746 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-23746

Vulnerability Analysis

The vulnerability stems from the SmartCardController service's use of insecure .NET Remoting configuration. The service exposes a TCP remoting channel that allows remote clients to invoke methods on server-side objects without proper authentication or authorization checks. This is classified as CWE-306 (Missing Authentication for Critical Function), where a critical system function—remote object invocation—lacks the necessary authentication mechanisms to restrict access to authorized users only.

The .NET Remoting framework, when configured with unsafe formatter settings, permits deserialization of arbitrary objects from remote clients. This creates a dangerous attack surface where an attacker can craft malicious serialized objects that, when deserialized by the server, can execute arbitrary code within the context of the service process. The SmartCardController service runs with elevated privileges to manage smart card operations, meaning successful exploitation grants the attacker those same elevated privileges on the target system.

Root Cause

The root cause of CVE-2026-23746 is the insecure configuration of the .NET Remoting channel in the SmartCardController service. Specifically, the service uses TypeFilterLevel.Full or equivalent unsafe formatter settings that allow unrestricted type deserialization. Combined with the absence of authentication requirements for remoting connections, this creates a perfect storm for remote exploitation. The service binds to a network-accessible TCP port without implementing channel-level security, IP filtering, or mutual authentication between clients and the server.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach the TCP port used by the SmartCardController service can initiate a .NET Remoting connection and invoke exposed methods on registered remote objects. The exploitation typically follows these stages:

1. Reconnaissance: Identify systems running the vulnerable SmartCardController service and determine the TCP port
2. Connection: Establish a .NET Remoting TCP channel connection to the target
3. Object Invocation: Invoke exposed remoting objects to perform initial operations such as arbitrary file reads
4. Escalation: Leverage known .NET Remoting deserialization gadgets to achieve arbitrary code execution
5. Post-Exploitation: Access sensitive financial card issuance data, extract service account credentials, or establish persistent access

The vulnerability can be exploited using existing .NET Remoting exploitation tools and techniques documented in security research. Attackers can read arbitrary files from the server to extract configuration data and credentials, coerce the service to authenticate to attacker-controlled systems (NTLM relay attacks), and ultimately execute arbitrary code on the compromised host.

Detection Methods for CVE-2026-23746

Indicators of Compromise

• Unexpected network connections to the SmartCardController service TCP port from external or untrusted IP addresses
• Anomalous file access patterns from DCG.SmartCardControllerService.exe, particularly reads of sensitive system files or configuration files outside normal operational scope
• NTLM authentication attempts originating from the service account to external or unexpected destinations
• Unexpected child processes spawned by DCG.SmartCardControllerService.exe

Detection Strategies

• Monitor network traffic for .NET Remoting protocol signatures connecting to the SmartCardController service port
• Implement file integrity monitoring on critical system directories and the IFI installation folder to detect unauthorized file access or modifications
• Configure Windows Security Event logging to capture process creation events (Event ID 4688) with command line auditing enabled for the SmartCardController service
• Deploy endpoint detection rules to identify known .NET deserialization attack payloads and gadget chains

Monitoring Recommendations

• Enable verbose logging on the SmartCardController service if supported and forward logs to a centralized SIEM
• Monitor for unusual outbound connections from servers hosting the IFI software, particularly SMB traffic that could indicate NTLM relay attempts
• Implement network segmentation monitoring to detect lateral movement attempts following potential exploitation

How to Mitigate CVE-2026-23746

Immediate Actions Required

• Upgrade Entrust IFI On Premise software to version 6.10.5 or 6.11.1 or later immediately
• If immediate patching is not possible, isolate affected systems by restricting network access to the SmartCardController service port using firewall rules
• Review service account permissions and apply principle of least privilege to minimize post-exploitation impact
• Audit system logs and network traffic for any indicators of prior exploitation

Patch Information

Entrust has released patched versions of the Instant Financial Issuance On Premise software that address this vulnerability. Organizations running version 5.x should upgrade to version 6.10.5 or 6.11.1 or later. Detailed patch information and download links are available through the Entrust Advisory on .NET Remoting Vulnerabilities. Additional technical analysis is available from VulnCheck's Advisory on Entrust RCE.

Workarounds

• Implement strict network access controls to limit connectivity to the SmartCardController service port to only authorized management workstations
• Deploy host-based firewall rules on affected servers to block incoming connections to the remoting port from untrusted networks
• Consider disabling the SmartCardController service temporarily if card issuance operations can be suspended during the patching window
• Enable Windows Defender Credential Guard to mitigate NTLM relay attack vectors

# Example Windows Firewall rule to restrict access to SmartCardController service
# Replace PORT_NUMBER with the actual remoting port and TRUSTED_IP with management subnet
netsh advfirewall firewall add rule name="Block SmartCardController Remoting" dir=in protocol=tcp localport=PORT_NUMBER action=block
netsh advfirewall firewall add rule name="Allow SmartCardController from Trusted" dir=in protocol=tcp localport=PORT_NUMBER remoteip=TRUSTED_IP action=allow