What is the CVSS score of CVE-2026-2999?

CVE-2026-2999 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows are affected by CVE-2026-2999?

IDExpert Windows Logon Agent contains a critical remote code execution vulnerability (CVSS 9.8) that allows unauthenticated attackers to execute arbitrary code on affected systems without requiring…. A patch is available.

How to fix or mitigate CVE-2026-2999?

Within 24 hours: Identify all systems running IDExpert Windows Logon Agent and isolate critical instances from untrusted networks if patching cannot be completed immediately. Within 7 days: Apply the available vendor patch to all affected systems and verify successful deployment. Within 30 days: Conduct security audits of patched systems and review logs for indicators of compromise during the vulnerability window.

Windows CVE-2026-2999

CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-03-02 twcert@cert.org.tw

Windows RCE Idexpert Changingtec

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 09, 2026 - 14:22 nvd

Patch available

CVE Published

Mar 02, 2026 - 07:16 nvd

CRITICAL 9.8

DescriptionCVE.org

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.

AnalysisAI

IDExpert Windows Logon Agent by Changing has an RCE vulnerability through download of code without integrity check, allowing malicious update injection.

Technical ContextAI

IDExpert Windows Logon Agent has a CWE-494 download of code without integrity check vulnerability, allowing MITM attackers to inject malicious updates.