CVE-2026-2713: IBM Trusteer Rapport DLL RCE Vulnerability

CVE-2026-2713 Overview

CVE-2026-2713 is a DLL uncontrolled search path element vulnerability (CWE-427) affecting IBM Trusteer Rapport installer version 3.5.2309.290. This vulnerability could allow a local attacker to execute arbitrary code on the system by placing a specially crafted DLL file in a compromised folder. When the installer runs, it searches for required DLLs in an insecure manner, potentially loading a malicious DLL planted by an attacker instead of the legitimate system library.

Critical Impact

Local attackers can achieve arbitrary code execution with the privileges of the user running the IBM Trusteer Rapport installer, potentially leading to full system compromise.

Affected Products

• IBM Trusteer Rapport installer version 3.5.2309.290

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-2713 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-2713

Vulnerability Analysis

This vulnerability is classified as a DLL Uncontrolled Search Path Element issue, which occurs when an application does not properly specify a search path for loading dynamic link libraries. When the IBM Trusteer Rapport installer executes, it attempts to load certain DLL files but does not enforce a secure search order, allowing an attacker to place a malicious DLL in a directory that the application searches before trusted system directories.

The local attack vector means that an attacker must have some level of access to the target system to plant the malicious DLL file. However, once the malicious library is in place, execution occurs automatically when a legitimate user runs the installer, enabling the attacker to execute code with the same privileges as the installer process.

Root Cause

The root cause of CVE-2026-2713 is improper DLL search path handling in the IBM Trusteer Rapport installer. The application fails to use secure methods for loading dynamic libraries, such as specifying absolute paths or using functions like SetDllDirectory() to restrict the search path. This allows the Windows loader to search through directories that may be writable by unprivileged users, including the current working directory or user-controlled folders in the PATH environment variable.

Attack Vector

The attack requires local access to the target system. An attacker would need to:

1. Identify which DLLs the IBM Trusteer Rapport installer attempts to load
2. Create a malicious DLL with the same name as a legitimately required library
3. Place the malicious DLL in a directory that appears earlier in the search path than the legitimate DLL location (such as the installer's working directory)
4. Wait for or socially engineer a user to execute the installer

When the installer runs and attempts to load the DLL, Windows' default search order may locate and load the attacker's malicious version first, resulting in arbitrary code execution within the context of the installer process.

Detection Methods for CVE-2026-2713

Indicators of Compromise

• Unexpected DLL files appearing in directories containing IBM Trusteer Rapport installer files
• DLL files with system library names located in non-standard directories such as user download folders or temp directories
• Process execution anomalies where the Trusteer Rapport installer loads DLLs from unusual paths
• File creation events in installer directories shortly before the installer is executed

Detection Strategies

• Monitor for DLL load events where the IBM Trusteer Rapport installer loads libraries from non-system directories
• Implement application whitelisting to detect execution of unsigned or untrusted code during installer operations
• Use endpoint detection and response (EDR) tools to identify DLL side-loading attempts
• Deploy file integrity monitoring on directories commonly used for software installation

Monitoring Recommendations

• Enable Windows DLL load auditing to track library loading behavior during installer execution
• Configure SIEM alerts for process creation events involving IBM Trusteer Rapport installer combined with suspicious DLL loading patterns
• Implement SentinelOne's behavioral AI to detect code execution anomalies during software installation processes
• Review Windows Event Logs for loader errors or warnings that may indicate failed or successful DLL hijacking attempts

How to Mitigate CVE-2026-2713

Immediate Actions Required

• Verify the integrity and source of all IBM Trusteer Rapport installer files before execution
• Run installers only from secure, trusted directories with restricted write permissions
• Ensure user accounts running the installer have appropriate privilege levels
• Clear the current working directory of any unexpected DLL files before running the installer
• Apply the security update from IBM when available

Patch Information

IBM has published a security advisory addressing this vulnerability. Organizations should apply the patch as described in the IBM Support Page. It is recommended to upgrade to a fixed version of IBM Trusteer Rapport that addresses the DLL search path vulnerability.

Workarounds

• Execute the installer from a clean, protected directory with restricted write access to prevent attackers from placing malicious DLLs
• Temporarily relocate the installer to a secure location such as C:\SecureInstall\ where only administrators have write permissions
• Use application control policies to restrict which DLLs can be loaded during installation processes
• Implement the principle of least privilege to limit potential damage if exploitation occurs
• Consider using SentinelOne Singularity to detect and block DLL side-loading attempts in real-time