SafeNet Logon Agent CVE-2026-0872
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity (MITM prerequisite per AT:P); low privilege required; scope change to Windows authentication session drives C:H/I:H.
Primary rating from Vendor (thalesgroup).
CVSS VectorVendor: thalesgroup
Lifecycle Timeline
5DescriptionCVE.org
Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.This issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2.
AnalysisAI
Signature spoofing through improper certificate validation in Thales SafeNet Agent for Windows Logon (versions 4.0.0, 4.1.1, and 4.1.2) permits a low-privileged network attacker who meets specific access prerequisites to present fraudulent certificates the agent accepts without adequate verification. The CVSS 4.0 vector's SC:H/SI:H indicators confirm that a successful exploit can undermine the entire downstream Windows authentication chain - effectively nullifying the MFA or certificate-based logon protection this agent is deployed to enforce. Publicly available exploit code exists per the E:P threat metric in the vendor's CVSS 4.0 vector; no active exploitation has been confirmed and EPSS stands at a low 0.03%.
Technical ContextAI
Thales SafeNet Agent for Windows Logon is an enterprise authentication agent that extends Windows logon with certificate-based or multi-factor authentication, typically integrated with SafeNet hardware tokens, smart cards, or PKI credentials. CWE-295 (Improper Certificate Validation) indicates the agent fails to properly verify certificate signatures or chain integrity during the logon handshake - a gap exploitable when an attacker can influence which certificate material the agent receives. Affected versions are explicitly enumerated as 4.0.0, 4.1.1, and 4.1.2 on Windows; no CPE strings were provided in the input data. This vulnerability class is common in PKI-integrated authentication components where signature verification, revocation checking (OCSP/CRL), or trust-anchor validation logic contains gaps that certificate substitution attacks can exploit.
Affected ProductsAI
Thales SafeNet Agent for Windows Logon versions 4.0.0, 4.1.1, and 4.1.2 on the Windows platform are explicitly confirmed as affected. No CPE strings were included in the available data. The primary vendor advisory is the Thales support portal KB article KB0030173, accessible at https://supportportal.thalesgroup.com/csm?sys_kb_id=247fd4a42b4a7290061af3f5f291bff1&id=kb_article_view. Product documentation covering the affected agent is available at https://thalesdocs.com/sta/agents/wla-windows_logon/wla-preinstallation_passwordless/index.html. Versions prior to 4.0.0 and any release beyond 4.1.2 are not stated as affected by the available data.
RemediationAI
Consult the Thales SafeNet support portal KB0030173 at https://supportportal.thalesgroup.com/csm?sys_kb_id=247fd4a42b4a7290061af3f5f291bff1&id=kb_article_view for the official fixed release - a specific patched version number is not confirmed in the available public data, so contact Thales PSIRT at psirt@thalesgroup.com to obtain the corrected package. As compensating controls pending upgrade, restrict network access to systems running the SafeNet Logon Agent so that only trusted infrastructure (domain controllers, RADIUS servers, PKI CAs, OCSP responders) can reach those hosts, reducing the MITM attack surface implied by the AT:P prerequisite. Additionally, enforce strict CRL or OCSP revocation checking at the network boundary if your PKI configuration permits it, and monitor Windows Security event logs for anomalous logon events that may indicate certificate substitution attempts. Note that network-layer MITM controls do not eliminate the underlying software defect and upgrade remains the definitive fix.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today