Remote Code Execution Vulnerability in IDExpert Windows Logon Agent by Changing
CVE-2026-2999

9.3CRITICAL

Key Information:

Vendor

Changing

Status
Idexpert Windows Logon Agent
Vendor
CVE Published:
2 March 2026

What is CVE-2026-2999?

The IDExpert Windows Logon Agent developed by Changing contains a vulnerability that allows remote attackers to execute arbitrary code on the affected system. By exploiting this flaw, attackers can manipulate the system to download and execute harmful binaries from a remote source without requiring any authentication. This significant security risk highlights the importance of securing systems to prevent unauthorized access and the execution of malicious code.

Affected Version(s)

IDExpert Windows Logon Agent 2.7.3.230719 <= 2.8.4.250925

References

https://www.twcert.org.tw/tw/cp-132-10740-b2eb2-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-10741-daed4-2.html
third-party-advisory
https://www.changingtec.com/news_detail.jsp?item_id=348
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.