Untrusted OpenSSL Configuration Load in the Windows VEN
The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges.
Severity
High: CVSS score is 7.0
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products and Patch Information
Security vulnerabilities addressed by this Security Alert affect the products listed below.
Affected Products | Affected Versions | Fixed Version |
|---|---|---|
Illumio Core VEN (Windows) | 24.2.20 | 26.2.20 |
Resolution
Upgrade to the latest release for a given major version.
References
See this link for more information.
Skipped Critical Patch Updates
Illumio strongly recommends that you apply the security patches as soon as possible. If you skipped one or more Critical Patch Updates and are concerned about products that do not have security patches announced in this update, review the previous advisories to determine appropriate actions.
Discovered By
Illumio Internal Security Team
Modification History
October, 2026: Initial Publication of CVE