Insecure Folder Permissions in the Windows VEN

The Illumio VEN for Windows installer is affected by an insecure permissions vulnerability. The installer grants the LOCAL SERVICE account full access to the VEN's data and installation folders, and a SYSTEM-privileged VEN component reads and trusts configuration and state files stored in those folders without validation.

See FAQs.

Severity

High: CVSS score is 7.8

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products and Patch Information

Security vulnerabilities addressed by this Security Alert affect the products listed below.

Affected Products	Affected Versions	Fixed Version
Illumio Core VEN (Windows)	26.2.30	26.2.30-S1
	26.2.12	26.2.12-S1
	25.2.41	25.2.41-S1
	25.2.40	25.2.40-S1
	25.2.31	25.2.31-S1
	25.2.20	25.2.20-S1
	25.2.10	25.2.10-S1
	24.2.40	24.2.40-S1
	24.2.35	24.2.35-S1
	24.2.30	24.2.30-S1
	24.2.20	24.2.20-S1
	24.2.11	24.2.11-S1
	24.2.10	24.2.10-S1
	23.2.31	23.2.31-S1
	23.2.31-LA	23.2.31-LA-S1
	23.2.30	23.2.30-S1
	23.2.24	23.2.24-S1
	23.2.24-LA	23.2.24-LA-S1
	23.2.23	23.2.23-S1
	23.2.22	23.2.22-S1
	23.2.22-LA	23.2.22-LA-S1

Resolution

Upgrade to the latest release for a given major version.

References

See this link for more information.

Skipped Critical Patch Updates

Illumio strongly recommends that you apply the security patches as soon as possible. If you skipped one or more Critical Patch Updates and are concerned about products that do not have security patches announced in this update, review the previous advisories to determine appropriate actions.

Discovered By

Illumio Internal Security Team

Modification History

October, 2026: Initial Publication of CVE

Illumio Advisories