CVE-2026-2999: Changingtec Idexpert RCE Vulnerability

CVE-2026-2999 Overview

CVE-2026-2999 is a remote code execution vulnerability in the IDExpert Windows Logon Agent developed by ChangingTec. The flaw allows unauthenticated remote attackers to force the agent to download arbitrary executable files from an attacker-controlled source and execute them on the target host. The vulnerability is tracked under CWE-494 (Download of Code Without Integrity Check) and affects Windows deployments of the IDExpert agent.

Critical Impact
Unauthenticated network attackers can achieve arbitrary code execution on Windows endpoints running the IDExpert Logon Agent, leading to full system compromise.

Affected Products

ChangingTec IDExpert Windows Logon Agent
Deployments matching cpe:2.3:a:changingtec:idexpert:*:*:*:*:*:windows:*:*
All IDExpert installations on Windows prior to the vendor-supplied patched build

Discovery Timeline

2026-03-02 - CVE-2026-2999 published to the National Vulnerability Database
2026-03-09 - Entry last modified in NVD

Technical Details for CVE-2026-2999

Vulnerability Analysis

The IDExpert Windows Logon Agent integrates with the Windows logon flow to support identity and authentication workflows. According to the TW-CERT Advisory #10741, the agent accepts instructions over the network that cause it to retrieve and execute remote binaries. No authentication is required to reach the vulnerable code path.

A remote attacker who can reach the agent's listening service can supply a URL referencing an executable. The agent downloads that file and runs it under the privileges of the agent process, which on a logon agent typically runs with elevated rights. Successful exploitation results in arbitrary code execution and full compromise of confidentiality, integrity, and availability on the host.

Root Cause

The root cause is improper handling of remotely supplied code, classified as [CWE-494]. The agent fetches and launches an executable without verifying the source, validating a digital signature, or enforcing integrity checks. There is also no authentication gate protecting the network interface that accepts the download-and-execute request.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted request to the exposed IDExpert agent service, pointing it at a hosted payload. The agent retrieves the payload over the network and executes it locally. Because the agent participates in Windows logon, payloads can target pre-authentication contexts and persist across user sessions.

No verified public proof-of-concept code is available at the time of writing. Refer to the TW-CERT bilingual advisories for additional technical context.

Detection Methods for CVE-2026-2999

Indicators of Compromise

Unexpected outbound HTTP or HTTPS connections originating from the IDExpert agent process to unfamiliar external hosts.
New executable files written to temporary or agent working directories shortly after inbound network traffic to the agent's listening port.
Child processes spawned by the IDExpert agent that are not part of the standard product behavior.
Windows logon-related services launching scripting interpreters such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Baseline the legitimate process tree and network destinations of the IDExpert agent, then alert on deviations.
Inspect endpoint telemetry for CreateProcess events where the parent is the IDExpert agent binary and the child is an unsigned or recently downloaded executable.
Hunt for file-write events from the agent followed within seconds by a process execution of the same file path.

Monitoring Recommendations

Forward Windows process, file, and network logs from systems running IDExpert to a central analytics platform for correlation.
Monitor the agent's listening TCP port for connections from outside the expected administrative network segments.
Track changes to the IDExpert installation directory and any auto-update or download staging folders.

How to Mitigate CVE-2026-2999

Immediate Actions Required

Apply the fixed build referenced in the ChangingTec security notice as soon as it is available in your environment.
Restrict network access to the IDExpert agent's listening service so that only trusted management hosts can reach it.
Inventory all Windows endpoints with the IDExpert Logon Agent installed and prioritize patching internet-exposed or DMZ-resident systems.

Patch Information

ChangingTec published a vendor advisory at the ChangingTec News Update describing the fix. Coordinated disclosure was handled through TW-CERT, with details available in TW-CERT Advisory #10741 (English) and TW-CERT Advisory #10740 (Traditional Chinese). Confirm the patched version number against the advisory before validating deployment.

Workarounds

Block inbound connections to the IDExpert agent's listening port at the host firewall, allowing only known administrative source addresses.
Place affected Windows hosts behind a network segment that denies untrusted east-west traffic to the agent service.
Disable the IDExpert Windows Logon Agent service on systems where it is not actively required until the patch is applied.

bash

# Example: restrict inbound access to the IDExpert agent port on Windows
# Replace <AGENT_PORT> with the port used by the IDExpert service
# Replace <ADMIN_SUBNET> with your trusted management network
New-NetFirewallRule -DisplayName "Restrict IDExpert Agent" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort <AGENT_PORT> `
  -RemoteAddress <ADMIN_SUBNET> `
  -Action Allow

New-NetFirewallRule -DisplayName "Block IDExpert Agent Default" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort <AGENT_PORT> `
  -Action Block