PT-2026-6558 · Thales · Safenet Agent For Windows Logon

Published 2026-02-05 · Updated 2026-02-13 · CVE-2026-0872

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Thales SafeNet Agent for Windows Logon versions 4.0.0 through 4.1.2

Description A flaw exists in the certificate validation process within SafeNet Agent for Windows Logon on Windows, potentially enabling signature spoofing. This issue stems from an insecure Active Directory Certificate Services (AD CS) certificate template configuration, which could allow an authenticated user to escalate privileges to Domain Admin.

Recommendations Update SafeNet Agent for Windows Logon to a version later than 4.1.2.

Fix

LPE

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-0872

Affected Products

Safenet Agent For Windows Logon

References · 8

• https://supportportal.thalesgroup.com/csm?sys_kb_id=247fd4a42b4a7290061af3f5f291bff1&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=5ecb72c73b927610381ecfaf55e45a0b&sysparm_article=KB0030173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0872 · Security Note
• https://t.me/CVEtracker/44610 · Telegram Post
• https://twitter.com/CVEarity/status/2022332296398078341 · Twitter Post
• https://twitter.com/Netwrix/status/2019380492680794592 · Twitter Post
• https://thalesdocs.com/sta/agents/wla-windows_logon/wla-preinstallation_passwordless/index.html · Note
• https://t.me/cveNotify/151924 · Telegram Post
• https://twitter.com/CVEnew/status/2022236681949352226 · Twitter Post