CrowdStrike LogScale Critical Arbitrary File Read Vulnerability Resolved

Italy's national Computer Security Incident Response Team (CSIRT-ITA) issued an alert on 23 April 2026 notifying that CrowdStrike has resolved a critical arbitrary file read vulnerability in its LogScale Self-Hosted platform. The flaw, catalogued as CVE-2026-40050, carries a critical severity rating and could enable an unauthenticated remote attacker to access arbitrary files on the affected server filesystem. The alert covers three affected version ranges: LogScale GA releases from 1.224.0 through 1.233.0 (inclusive), LogScale Self-Hosted 1.234.x prior to version 1.234.1, and LogScale Self-Hosted LTS 1.228.x up to and including 1.228.1. CrowdStrike has published a corresponding security advisory and patched the vulnerability.

Organizations that operate LogScale Self-Hosted instances should identify their current version and update without delay to a patched release as directed by the CrowdStrike security bulletin. Failure to patch leaves the server vulnerable to unauthenticated remote file access, which could expose configuration files, credentials, or other sensitive data stored on the system. Given the High (66.41) system impact rating assigned by CSIRT-ITA, this vulnerability should be treated as a priority remediation item for any Italian public-sector entity or regulated industry running affected LogScale deployments.