CrowdStrike has disclosed a critical vulnerability in its LogScale platform that could allow remote attackers to read arbitrary files from affected servers without authentication.
The flaw, tracked as CVE-2026-40050, has been assigned a CVSS score of 9.8, highlighting its severe security impact.
The issue stems from an unauthenticated path traversal vulnerability in a specific LogScale cluster API endpoint.
If this endpoint is exposed, attackers can exploit improper input validation to access sensitive files on the server’s filesystem.
The vulnerability is categorized under CWE-22 (Path Traversal) and CWE-306 (Missing Authentication for Critical Function), making it particularly dangerous in environments with weak access controls.
According to CrowdStrike, the vulnerability affects only self-hosted deployments of LogScale and does not impact customers using its Next-Gen SIEM platform.
For LogScale SaaS customers, the company has already implemented network-layer protections across all clusters as of April 7, 2026.
CrowdStrike also confirmed that a thorough review of log data found no evidence of active exploitation in the wild.
The affected versions include LogScale Self-Hosted releases from 1.224.0 through 1.234.0, as well as Long-Term Support (LTS) versions 1.228.0 and 1.228.1.
Organizations running these versions are at risk if the vulnerable API endpoint is accessible from external networks.
To mitigate the risk, CrowdStrike has released patched versions and strongly urges customers to upgrade immediately.
Secure versions include 1.235.1, 1.234.1, 1.233.1, and LTS version 1.228.2 or later. Applying these updates eliminates the vulnerability and prevents unauthorized file access.
Although no exploitation has been detected so far, security experts warn that vulnerabilities of this nature are often quickly weaponized once publicly disclosed.
Attackers could potentially leverage this flaw to extract configuration files, credentials, or other sensitive data, which may lead to further compromise of the environment.
CrowdStrike stated that the vulnerability was discovered during its internal product testing processes, reflecting ongoing efforts to identify and address security weaknesses proactively.
The company continues to monitor for any signs of attempted exploitation and recommends that customers follow standard incident response practices, including log monitoring and threat detection.
Organizations using self-hosted LogScale instances should prioritize patching and ensure that sensitive API endpoints are not exposed to the internet.
Implementing network restrictions and access controls can further reduce the attack surface.
This incident serves as a reminder of the importance of timely patch management and secure configuration, especially for systems handling large volumes of log and security data.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=The flaw, tracked as CVE-2026-40050, has been assigned a CVSS score of 9.8, highlighting its severe security impact.){kind=link}