CrowdStrike's LogScale product contained a critical unauthenticated path traversal vulnerability (CVE-2026-40050) that allows remote attackers to read arbitrary files from the server filesystem. This vulnerability was discovered internally and affects self-hosted deployments; SaaS customers are already mitigated. Tenable's Nessus vulnerability scanner on Windows was found vulnerable to a high-severity flaw (CVE-2026-33694) where attackers could use junctions to delete arbitrary files with System privileges and potentially achieve arbitrary code execution with elevated privileges. Both vendors have published advisories and patches to address these vulnerabilities.

The CrowdStrike LogScale vulnerability could allow unauthenticated remote attackers to read arbitrary files on affected self-hosted servers, potentially exposing sensitive data. The Tenable Nessus vulnerability could enable attackers to delete arbitrary files with System privileges and execute arbitrary code with elevated privileges on Windows systems running Nessus, posing a significant risk to system integrity and security. There is no evidence of exploitation in the wild for the CrowdStrike vulnerability. The impact of exploitation could be severe given the critical and high severity ratings.

CrowdStrike has mitigated the LogScale vulnerability for SaaS customers; self-hosted LogScale users should update to the patched version as soon as possible. Tenable has released patches for the Nessus vulnerability affecting Windows; users should apply these updates promptly. Both vendors have published advisories with detailed remediation instructions. There is no indication that additional mitigation steps beyond applying the official patches are required.