What is the CVSS score of CVE-2026-17561?

CVE-2026-17561 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Logsign SIEM are affected by CVE-2026-17561?

Logsign SIEM versions prior to 6.4.108 contain a critical remote code execution vulnerability (CVE-2026-17561) allowing unauthenticated attackers to compromise affected appliances with a single…. A patch is available.

How to fix or mitigate CVE-2026-17561?

Within 24 hours, inventory all Logsign SIEM deployments and confirm versions in production; implement firewall rules restricting network access to management interfaces to trusted administrative networks only. Within 7 days, contact Logsign support to confirm patch release timeline and request interim mitigation guidance; enable comprehensive access logging and deploy IDS/IPS signatures targeting CVE-2026-17561 exploitation attempts if available from vendor or threat intelligence feeds. Within 30 days, apply Logsign SIEM version 6.4.108 or later immediately upon release; if patching timeline exceeds 30 days, evaluate alternative log aggregation platforms or implement additional network segmentation (air-gapping) to isolate the affected SIEM infrastructure.

Logsign SIEM CVE-2026-17561

EUVD-2026-51534 CRITICAL

Code Injection (CWE-94)

2026-07-31 iletisim@usom.gov.tr

GHSA-6rqw-8xp6-qjhg

RCE Code Injection

9.8

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable code injection with no user interaction yields AV:N/AC:L/PR:N/UI:N, and RCE on the appliance gives full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 31, 2026 - 14:02 EUVD

Analysis Generated

Jul 31, 2026 - 13:30 vuln.today

CVE Published

Jul 31, 2026 - 13:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection.

This issue affects Logsign SIEM: before 6.4.108.

AnalysisAI

Remote code execution in Logsign SIEM (all versions before 6.4.108) allows unauthenticated network attackers to inject and execute arbitrary code, as tracked under CVE-2026-17561 (CWE-94, Code Injection). Reported through Turkey's national CERT (USOM), the flaw carries a critical CVSS 9.8 with a fully remote, no-privilege, no-interaction vector, meaning a single crafted request can compromise the appliance. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch.

Technical ContextAI

Logsign SIEM is a security information and event management platform developed by Innotim (Logsign), commonly deployed as a centralized log-collection and correlation appliance that ingests data from across an enterprise network. The root cause is CWE-94 (Improper Control of Generation of Code / 'Code Injection'), meaning attacker-controlled input is incorporated into dynamically generated or evaluated code - for example unsafe evaluation of user-supplied parameters, template/expression injection, or command construction in an exposed web/API component. Because a SIEM inherently receives inputs from many network sources and exposes management interfaces, an injection point reachable over the network (AV:N) is especially dangerous. No CPE strings were provided in the input, so exact affected configuration identifiers cannot be enumerated beyond the vendor's stated version boundary.

RemediationAI

Vendor-released patch: upgrade Logsign SIEM to version 6.4.108 or later, which is the fixed release per the version boundary stated in the CVE ('before 6.4.108'); consult the USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0717 for vendor confirmation and upgrade instructions. Until the appliance is patched, restrict network exposure of the SIEM management and API interfaces to a dedicated administrative VLAN or trusted management network and block direct Internet/untrusted-segment access to its web/API ports, accepting the trade-off that legitimate remote administration and any externally-sourced ingestion endpoints may need re-routing; place the appliance behind a WAF or reverse proxy and monitor for anomalous requests to injection-prone endpoints. These are compensating controls only - because the flaw is unauthenticated code injection, patching to 6.4.108 is the sole reliable fix.