CrowdStrike LogScale CVE-2026-40050

No special conditions - remote unauthenticated exploitation against self-hosted LogScale deployments where cluster API endpoints are network-accessible. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity. However, exploitation is limited to self-hosted LogScale environments only; Next-Gen SIEM customers are not affected by platform architecture differences. Additional limiting factor is that cluster API endpoints may not be internet-exposed in many production deployments, as these endpoints are typically intended for internal cluster management rather than external access. Organizations that follow network segmentation best practices and restrict cluster API access to management VLANs or internal networks are protected from internet-based attacks but remain vulnerable to internal threat actors or lateral movement scenarios.

The CVSS 9.8 critical score reflects maximum severity across all metrics: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, real-world risk varies significantly by deployment model. For Next-Gen SIEM customers, risk is zero as they are explicitly not affected. For LogScale SaaS customers, CrowdStrike deployed network-layer compensating controls on April 7, 2026, and confirmed no exploitation occurred, reducing residual risk to minimal. For self-hosted LogScale customers, risk remains critical until patching, as the vulnerability requires only network access to an exposed cluster API endpoint with no authentication barriers. The vulnerability was discovered through vendor internal testing rather than adversary activity, and CrowdStrike's statement of 'no evidence of exploitation' after proactive log review suggests this has not been weaponized in the wild. EPSS probability and CISA KEV status are not available, preventing quantitative exploitation likelihood assessment. The high CVSS score is appropriate for the technical severity, but actual exploitation risk depends heavily on whether cluster API endpoints are internet-exposed versus restricted to internal management networks in typical self-hosted deployments.

An unauthenticated remote attacker identifies an internet-exposed LogScale self-hosted deployment and scans for accessible cluster API endpoints. The attacker crafts HTTP requests to the vulnerable endpoint with path traversal sequences (e.g., ../../../../etc/passwd or Windows equivalents) to read arbitrary files from the server filesystem. Successfully exploited, the attacker extracts sensitive files including LogScale configuration files containing database credentials, API keys, authentication tokens, or customer log data stored on the server, enabling further compromise of the logging infrastructure and potentially pivoting to connected systems. The CVSS vector (AC:L/UI:N) indicates exploitation requires minimal technical skill once the vulnerable endpoint is located.