What is the CVSS score of EUVD-2026-60161?

EUVD-2026-60161 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Logsign SIEM are affected by EUVD-2026-60161?

Logsign SIEM versions 6.4.97-6.4.113 contain a critical credential extraction flaw (CVSS 9.0) that compromises the security model of the entire logging infrastructure.. A patch is available.

How to fix or mitigate EUVD-2026-60161?

Within 24 hours, identify deployed Logsign SIEM versions (check via Settings/About) and immediately escalate versions 6.4.97-6.4.113 to emergency patching status; restrict SIEM administrative access to essential personnel only, and audit admin activity logs for any unauthorized credential access. Within 7 days, upgrade all affected instances to version 6.4.114 or later following vendor upgrade procedures and conduct functional testing on critical integrations. Within 30 days, rotate all credentials that were stored in the vulnerable SIEM versions, and conduct threat hunting on downstream systems for signs of unauthorized access or lateral movement.

Logsign SIEM EUVD-2026-60161

| CVE-2026-14564 CRITICAL

Insufficiently Protected Credentials (CWE-522)

2026-08-17 TR-CERT

GHSA-pp45-9qg8-f483

Information Disclosure Logsign Siem

9.0

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

6.8 MEDIUM

Requires an existing high-privilege account (PR:H) over the network; impact is disclosure of embedded credentials (C:H) with no described modification or availability loss (I:N/A:N), and S:C reflects that stolen secrets affect connected systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 13:25 vuln.today

Patch available

Aug 17, 2026 - 13:02 EUVD

CVE Published

Aug 17, 2026 - 12:26 nvd

CRITICAL 9.0

DescriptionCVE.org

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data.

This issue affects Logsign SIEM: from 6.4.97 before 6.4.114.

AnalysisAI

Credential exposure in Logsign SIEM (versions 6.4.97 up to but not including 6.4.114) allows a high-privilege authenticated user to retrieve embedded sensitive data such as stored integration or log-source credentials. The issue was reported by Turkey's national CERT (TR-CERT, advisory TR-26-0847) and carries a vendor CVSS of 9.0; a fixed release (6.4.114) is available and no public exploit has been identified at time of analysis. Because a SIEM aggregates credentials for many connected systems, recovered secrets can enable pivoting well beyond the SIEM itself.

Technical ContextAI

The flaw is classified as CWE-522 (Insufficiently Protected Credentials), a weakness class where secrets are stored or handled without adequate protection (weak or reversible encryption, exposure through an API/UI, or storage that privileged users can read back in cleartext). Logsign SIEM is a security information and event management platform that ingests logs from numerous sources and therefore stores credentials for those integrations (collectors, connectors, service accounts). The single affected CPE is cpe:2.3:a:innotim_software_telecommunications_and_consulting_trade_ltd._co.:logsign_siem, confirming the product is the Innotim/Logsign SIEM application. The root cause is that these embedded credentials are recoverable by an actor who already holds elevated access, rather than being one-way protected or scoped away from operator visibility.

RemediationAI

Upgrade to Logsign SIEM 6.4.114 or later, which is the vendor-released patched version and the first build outside the affected range; a patch is confirmed available per the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0847). Until the upgrade is applied, reduce exposure by tightly restricting the number of high-privilege SIEM accounts (since PR:H is the exploitation prerequisite), enforcing MFA and strong session controls on administrative logins, and limiting network reachability of the SIEM management interface to a trusted administration segment; note these controls reduce who can reach the vulnerable functionality but do not remove the underlying weakness. As a defense-in-depth measure that assumes possible prior exposure, rotate any credentials that Logsign stored for connected log sources and integrations, since those are the sensitive data at risk.