Logsign SIEM EUVD-2026-88290

Requires a valid low-privilege authenticated account (PR:L) on a network-reachable Logsign SIEM instance running an affected version (6.4.101 up to but not including 6.4.117); no user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is limited by the authentication prerequisite - a fully anonymous attacker cannot trigger it without first obtaining credentials or access to the SIEM interface - and by being confined to the enumerated version window, so patched (>=6.4.117) or unaffected deployments are not at risk. The exact vulnerable feature/endpoint is not specified in the advisory data.

The vendor-style CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity code-injection flaw that requires only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with the CWE-94/RCE tags. This is a genuinely serious signal because a SIEM is a high-value target holding aggregated security telemetry and often running with broad privileges, so code execution there can compromise an organization's entire detection/monitoring fabric. However, real-world urgency is tempered by missing exploitation signals: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automated weaponization at time of analysis. The PR:L requirement further limits the attacker set to those already holding some valid (even low-privilege) account, making this more of a privilege-escalation-to-RCE risk than a fully anonymous internet-wide threat. Net: a legitimately high-severity, patch-worthy flaw for anyone running the affected Logsign SIEM versions, but current evidence points to it being a high-CVSS issue without confirmed in-the-wild exploitation rather than an emergency mass-exploitation event.

An attacker with a low-privilege authenticated account on the Logsign SIEM web application submits crafted input to a vulnerable parameter that is passed into a code-generation/evaluation path, causing arbitrary code to execute on the SIEM host. Because no user interaction is needed and the attack is over the network with low complexity, the actor gains code execution and can pivot to tamper with logs, disable detections, or move laterally. No public exploit code was identified in the provided data, so exploitation would currently require independent vulnerability research.