Local privilege escalation via insecure folder permissions
Affects Illumio Core VEN for Windows in several release lines, where the installer grants LOCAL SERVICE full access to the VEN data and installation folders. Each affected line has a -S1 fix, such as 26.2.30-S1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 26.2.30-S1, 26.2.12-S1, 25.2.41-S1, 25.2.40-S1, 25.2.31-S1, and 16 more
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected Illumio Core VEN for Windows versions (installer grants LOCAL SERVICE full access to VEN data and installation folders)
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.8/10CVSS 7.8
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affected Illumio Core VEN for Windows versions (installer grants LOCAL SERVICE full access to VEN data and installation folders)Upgrade to a fixed version: 26.2.30-S1, 26.2.12-S1, 25.2.41-S1, 25.2.40-S1, 25.2.31-S1, or one of 16 more.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- Illumio Core Ven
From 26.2.30 · fixed in 26.2.30-S1; From 26.2.12 · fixed in 26.2.12-S1; From 25.2.41 · fixed in 25.2.41-S1; From 25.2.40 · fixed in 25.2.40-S1; From 25.2.31 · fixed in 25.2.31-S1; From 25.2.20 · fixed in 25.2.20-S1; From 25.2.10 · fixed in 25.2.10-S1; From 24.2.40 · fixed in 24.2.40-S1; From 24.2.35 · fixed in 24.2.35-S1; From 24.2.30 · fixed in 24.2.30-S1; From 24.2.20 · fixed in 24.2.20-S1; From 24.2.11 · fixed in 24.2.11-S1; From 24.2.10 · fixed in 24.2.10-S1; From 23.2.31 · fixed in 23.2.31-S1; From 23.2.31-LA · fixed in 23.2.31-LA-S1; From 23.2.30 · fixed in 23.2.30-S1; From 23.2.24 · fixed in 23.2.24-S1; From 23.2.24-LA · fixed in 23.2.24-LA-S1; From 23.2.23 · fixed in 23.2.23-S1; From 23.2.22 · fixed in 23.2.22-S1; From 23.2.22-LA · fixed in 23.2.22-LA-S1
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-114031
Is CVE-2026-114031 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The Windows installer gives the LOCAL SERVICE account full access to the VEN's data and installation folders. Because of these insecure folder permissions, a local account could gain higher privileges on the machine.Source: product-docs-repo.illumio.com
Which versions are affected by CVE-2026-114031?
Core Ven: from 26.2.30 before 26.2.30-S1; from 26.2.12 before 26.2.12-S1; from 25.2.41 before 25.2.41-S1; from 25.2.40 before 25.2.40-S1; from 25.2.31 before 25.2.31-S1; from 25.2.20 before 25.2.20-S1; from 25.2.10 before 25.2.10-S1; from 24.2.40 before 24.2.40-S1; from 24.2.35 before 24.2.35-S1; from 24.2.30 before 24.2.30-S1; from 24.2.20 before 24.2.20-S1; from 24.2.11 before 24.2.11-S1; from 24.2.10 before 24.2.10-S1; from 23.2.31 before 23.2.31-S1; from 23.2.31-LA before 23.2.31-LA-S1; from 23.2.30 before 23.2.30-S1; from 23.2.24 before 23.2.24-S1; from 23.2.24-LA before 23.2.24-LA-S1; from 23.2.23 before 23.2.23-S1; from 23.2.22 before 23.2.22-S1; from 23.2.22-LA before 23.2.22-LA-S1.Source: cve.now feed data
Am I affected, and how do I check?
The issue is in Illumio Core VEN for Windows builds from the listed affected versions, such as 26.2.12, 25.2.10, 24.2.10 and 23.2.22. To check, compare the installed VEN version against the listed ranges and check whether the installer granted LOCAL SERVICE full access to the data and installation folders.Source: product-docs-repo.illumio.com
How do I fix CVE-2026-114031?
Upgrade to the -S1 release for the same release line, such as 26.2.30-S1 for 26.2.30 or 25.2.41-S1 for 25.2.41. Each listed fixed version is the first build with the corrected folder permissions.Source: product-docs-repo.illumio.com