CVE-2026-92626 Overview
CVE-2026-92626 is an unauthenticated denial of service vulnerability affecting Control iD iDSecure versions prior to 4.8.3.0. The flaw resides in the /api/dguardintegration/dguardVersion endpoint, which dereferences DGuard integration login state that may be unset. This triggers an unhandled null reference exception [CWE-476] inside an async void method, so the exception escapes the caller and can terminate the iDSecure process. A remote attacker can crash the access control service by issuing a single HTTP request, with no authentication required.
Critical Impact
Unauthenticated network attackers can remotely terminate the iDSecure process, disrupting physical access control operations until the service is restarted.
Affected Products
- Control iD iDSecure versions prior to 4.8.3.0
Discovery Timeline
- 2026-09-16 - CVE-2026-92626 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92626
Vulnerability Analysis
The vulnerability is a null pointer dereference [CWE-476] reachable through the unauthenticated REST endpoint /api/dguardintegration/dguardVersion. When the endpoint is invoked, it reads DGuard integration login state that the application assumes has already been initialized. If that state has not been set, the dereference raises a null reference exception.
The endpoint handler is implemented as an asynchronous method with a void return type. In .NET, exceptions thrown from async void methods are not observed by the calling code and propagate to the synchronization context. In an ASP.NET worker process, an unobserved exception of this kind can crash the hosting process, terminating iDSecure and interrupting physical access control workflows tied to the service.
Root Cause
The root cause is missing null validation on the DGuard integration login state before it is dereferenced, combined with the use of async void for the handler. The handler pattern prevents structured exception handling from catching the fault, so the runtime treats the exception as unhandled and terminates the process.
Attack Vector
Exploitation requires only network reachability to the iDSecure management interface. An attacker sends an HTTP request to /api/dguardintegration/dguardVersion without credentials. If DGuard integration has not been authenticated in the current session state, the request triggers the null dereference and crashes the service. Repeated requests after restart re-trigger the crash, producing a sustained denial of service.
No verified proof-of-concept code is public. Refer to the Tenable Security Research Report for additional technical detail.
Detection Methods for CVE-2026-92626
Indicators of Compromise
- HTTP requests to the URI path /api/dguardintegration/dguardVersion from unauthenticated or unexpected source addresses.
- Unexpected termination of the iDSecure host process, followed by service restart events in Windows Event Log or the iDSecure application log.
- System.NullReferenceException entries referencing DGuard integration components in application crash dumps or .NET Runtime event source records.
Detection Strategies
- Alert on any inbound request to /api/dguardintegration/dguardVersion that lacks a valid authenticated session context.
- Correlate iDSecure process exit or restart events with HTTP access log entries for the DGuard integration endpoint within a short time window.
- Baseline normal request volume to iDSecure API endpoints and alert on bursts of requests to management URIs from a single source.
Monitoring Recommendations
- Forward iDSecure application logs, IIS or Kestrel access logs, and Windows Application event logs to a centralized logging platform for correlation.
- Track process uptime for the iDSecure service and alert on repeated restart cycles.
- Monitor perimeter and internal network telemetry for scanning activity that enumerates iDSecure API paths.
How to Mitigate CVE-2026-92626
Immediate Actions Required
- Upgrade Control iD iDSecure to version 4.8.3.0 or later on all deployments.
- Restrict network access to the iDSecure management interface to trusted administrative networks using firewall or ACL rules.
- Review authentication and logging configuration to ensure requests to /api/dguardintegration/* are captured for audit.
Patch Information
Control iD addresses this issue in iDSecure 4.8.3.0. Administrators should apply the vendor-supplied update to eliminate the null dereference and stabilize the async void handler behavior. Consult the Tenable Security Research Report for advisory references.
Workarounds
- Place the iDSecure API behind a reverse proxy or web application firewall that blocks unauthenticated requests to /api/dguardintegration/dguardVersion.
- Segment the iDSecure server into a restricted VLAN reachable only from operator workstations and integration hosts.
- Configure service recovery options in Windows to automatically restart the iDSecure service if it terminates, reducing outage duration until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
