CVE-2026-114032 PUBLISHED

Local privilege escalation via untrusted OpenSSL configuration

Assigner: Illumio
Reserved: 20.10.2026 Published: 09.11.2026 Updated: 09.11.2026

The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Illumio
Product	Core Ven
Versions	Default: unaffected affected from 24.2.20 to 26.2.20 (excl.)

References

https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/untrusted-openssl-configuration-load-in-the-windows-ven.html

Problem Types

CWE-427 Uncontrolled search path element CWE

Impacts

CAPEC-38 Leveraging/Manipulating Configuration File Search Paths