IGEL UMS Vulnerability Allows Remote Information Disclosure

CERT-Bund published security advisory WID-SEC-2026-0957 addressing a critical information disclosure vulnerability in IGEL Universal Management Suite (UMS). The flaw has a CVSS Base Score of 8.6 (high) and a Temporal Score of 7.5 (high), with confirmed remote attack capability. The vulnerability affects all versions below 12.11.100 on Linux and UNIX operating systems. An unauthenticated, remote attacker can exploit this weakness to disclose system information.

Organizations using IGEL UMS should immediately identify whether their systems are running affected versions (prior to 12.11.100). Priority should be given to applying the vendor-supplied patch or implementing available mitigations. Since this is a remote, anonymous exploit vector, unpatched systems should be considered at immediate risk, particularly for government agencies and enterprises managing sensitive endpoints.