Loading story…
CrowdStrike disclosed CVE-2026-40050, a critical unauthenticated path traversal flaw in specific self-hosted LogScale GA and LTS versions that could let a remote attacker read arbitrary files from the server filesystem without credentials. The vulnerability affects a cluster API endpoint and carries a CVSS 9.8 rating with classifications including CWE-22 and CWE-306. CrowdStrike said the issue was identified during internal product testing and that a review of available logs found no evidence of exploitation.
CrowdStrike said Next-Gen SIEM customers are not affected, while LogScale SaaS environments were protected through network-layer blocks deployed across clusters on April 7, 2026. The company urged self-hosted customers to upgrade immediately to patched releases, including 1.235.1+, 1.234.1+, 1.233.1+, or 1.228.2 LTS+, and to monitor systems for signs of unauthorized access or file exfiltration.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CrowdStrike disclosed CVE-2026-40050, a critical unauthenticated path traversal vulnerability in specific self-hosted LogScale versions that could let remote attackers read arbitrary files without authentication. The company said it identified the flaw during internal product testing, found no evidence of exploitation after reviewing logs, and advised customers to upgrade to patched releases.
CrowdStrike said it deployed network-layer blocks to all LogScale SaaS clusters to mitigate the unauthenticated path traversal issue. The company also stated that Next-Gen SIEM customers were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcecyber.gc.ca
Open sourcerunzero.com
Open sourcecybersecuritynews.com
Open sourcecrowdstrike.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk disclosed **CVE-2026-20253**, a critical unauthenticated vulnerability in the PostgreSQL sidecar component of **Splunk Enterprise** and **Splunk Cloud Platform** that lets a network-reachable attacker create or truncate arbitrary files on the host. The flaw, tracked as **`VULN-67169`** and **`SVD-2026-0603`**, is rated **CVSS 9.8** and affects Splunk Enterprise `10.2.0` through `10.2.3` and `10.0.0` through `10.0.6`, as well as Splunk Cloud Platform versions below `10.4.2604.3` and below `10.2.2510.14`. Splunk said fixed versions are available, cloud instances are being actively patched, and no workaround exists other than upgrading. Splunk also published security content tied to **`SVD-2026-0603`** to help defenders simulate and validate detection of the exposed sidecar behavior, including replayable attack data mapped to **MITRE ATT&CK `T1210`**. Separately, the company disclosed **CVE-2026-20140**, a Windows-only local privilege-escalation flaw in Splunk Enterprise caused by DLL search-order hijacking during service startup; that issue can allow a low-privileged local user to gain **`NT AUTHORITY\SYSTEM`** privileges and has been fixed in supported branches, with Splunk advising upgrades, tighter write permissions, and monitoring for suspicious DLL drops and service restarts.
Jul 13, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026