Answer in brief
CVE-2026-114031 records a High severity (CVSS 7.8) vulnerability in Local privilege escalation via insecure folder permissions. The current sources do not mark it as known exploited. The current feed maps Illumio/Core Ven (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Illumio/Core Ven (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Illumio/Core Vengeneric | >=26.2.30 <26.2.30-S1 || >=26.2.12 <26.2.12-S1 || >=25.2.41 <25.2.41-S1 || >=25.2.40 <25.2.40-S1 || >=25.2.31 <25.2.31-S1 || >=25.2.20 <25.2.20-S1 || >=25.2.10 <25.2.10-S1 || >=24.2.40 <24.2.40-S1 || >=24.2.35 <24.2.35-S1 || >=24.2.30 <24.2.30-S1 || >=24.2.20 <24.2.20-S1 || >=24.2.11 <24.2.11-S1 || >=24.2.10 <24.2.10-S1 || >=23.2.31 <23.2.31-S1 || >=23.2.31-LA <23.2.31-LA-S1 || >=23.2.30 <23.2.30-S1 || >=23.2.24 <23.2.24-S1 || >=23.2.24-LA <23.2.24-LA-S1 || >=23.2.23 <23.2.23-S1 || >=23.2.22 <23.2.22-S1 || >=23.2.22-LA <23.2.22-LA-S1 | 26.2.30-S1, 26.2.12-S1, 25.2.41-S1, 25.2.40-S1, 25.2.31-S1, 25.2.20-S1, 25.2.10-S1, 24.2.40-S1, 24.2.35-S1, 24.2.30-S1, 24.2.20-S1, 24.2.11-S1, 24.2.10-S1, 23.2.31-S1, 23.2.31-LA-S1, 23.2.30-S1, 23.2.24-S1, 23.2.24-LA-S1, 23.2.23-S1, 23.2.22-S1, 23.2.22-LA-S1 |
Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 9, 2026
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account.
Quoted source text, attributed separately from HOL analysis.