CVE-2026-2999

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - twcert@cert.org.tw

Published

2026-03-02

Last modified

2026-03-02

Weaknesses

CWE-494

Affected products

• Idexpert Windows Logon Agent (Changing)
• Idexpert (Changingtec)

References

• https://www.changingtec.com/news_detail.jsp?item_id=348
• https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html
• https://www.twcert.org.tw/tw/cp-132-10740-b2eb2-1.html