CVE-2026-92626

Control iD iDSecure, an on-premises access control management platform, versions prior to 4.8.3.0 contain an unauthenticated denial-of-service flaw (CWE-476). An attacker can send a simple network request to the /api/dguardintegration/dguardVersion endpoint, which dereferences the DGuard integration login state without checking whether it is set, triggering an unhandled null reference exception. Because the exception is raised inside an asynchronous method that returns void, it is never observed by a caller and can crash the entire iDSecure process. Any organization running an affected version is exposed, with the greatest risk to instances whose web API is reachable by untrusted networks. No public proof-of-concept is known, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Upgrade iDSecure to version 4.8.3.0 or later, which resolves the flaw. If upgrading is not immediately possible, restrict network access to the iDSecure server so that only trusted hosts can reach its web API, and monitor for unexplained iDSecure process restarts or crashes, which would indicate attempted exploitation.