Windows CVE-2026-3000

CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-03-02 twcert@cert.org.tw

Windows RCE Idexpert Changingtec

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 09, 2026 - 14:21 nvd

Patch available

CVE Published

Mar 02, 2026 - 07:16 nvd

CRITICAL 9.8

DescriptionCVE.org

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.

AnalysisAI

IDExpert Windows Logon Agent has a second RCE vulnerability through another unsigned code download path.

Technical ContextAI

CWE-494 in a second code download path in IDExpert, distinct from CVE-2026-2999.

RemediationAI

Apply patches for both CVEs.

More in Windows

View all

CVE-2019-0803 HIGH Act Now POC

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM Act Now POC

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

CVE-2025-33053 HIGH Act Now POC

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2025-13315 CRITICAL Emergency POC

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b

CVE-2013-10047 CRITICAL Emergency POC

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL Emergency POC

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

CVE-2025-34101 CRITICAL Emergency POC

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

CVE-2025-13316 HIGH Act Now POC

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred

CVE-2025-34095 CRITICAL Emergency POC

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/

CVE-2025-11953 CRITICAL Act Now POC

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo

CVE-2025-24054 MEDIUM This Month POC

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-494 – Download of Code Without Integrity Check

View all

CVE-2026-27180 CRITICAL POC

CVE-2026-3502 HIGH POC

CVE-2025-15556 HIGH

CVE-2025-56513 CRITICAL POC

CVE-2020-28332 CRITICAL POC

CVE-2022-24644 HIGH POC

CVE-2022-28944 HIGH POC

CVE-2025-57431 HIGH POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2026-3000 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy