TI-2026-14400 Aliases CVE-2026-17561 GHSA-6rqw-8xp6-qjhg

Unauthenticated RCE in Innotim Software's Logsign SIEM

MEDIUM 50CWE-94Published 2026-07-31 · Updated 2026-08-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.115.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00564 47th percentileScored 2026-11-07

Fix Fixed Logsign SIEM (Innotim Software, Telecommunications and Consulting Trade Ltd. Co.): 6.4.115

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Innotim Software Telecommunications and Consulting Trade Ltd. Co.	Logsign SIEM	before 6.4.115	6.4.115	Patch available	CNA

Logsign SIEM VendorInnotim Software Telecommunications and Consulting Trade Ltd. Co. Affected before 6.4.115 Fixed in 6.4.115 Patch available CNA

Remediation

Fix · CNA Logsign SIEM (Innotim Software, Telecommunications and Consulting Trade Ltd. Co.) Fixed in 6.4.115

Timeline

2026-10-02 Threatist record created from CVE-2026-17561
2026-10-03 Alias added: GHSA-6rqw-8xp6-qjhg

References

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0717

TI-2026-12288 Sensitive Data Exposure in Innotim Software's Logsign SIEM CVSS 3.1CRITICAL 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences