The flaw in the Illumio VEN installer grants the LOCAL SERVICE account full access to the VEN data and installation folders, which are read and trusted by the SYSTEM‑privileged illumio-ven-ctl component. As a result, a local attacker who can execute code as LOCAL SERVICE can modify the VEN configuration so that illumio-ven-ctl runs an injected command with SYSTEM privileges. This grants the attacker arbitrary system‑level access, allowing full control over the host. The vulnerability is classified as an Access Control weakness (CWE‑732) and has a CVSS score of 7.8, indicating high severity.

The vulnerability affects the Illumio Core VEN for Windows. Affected releases include all Windows editions of the Illumio VEN product that deploy the vulnerable installer; specific affected version numbers were not disclosed in the advisory.

The CVSS score of 7.8 underscores a high risk, but the EPSS score is not available and the issue is not listed in CISA's KEV catalog, so the broader threat landscape remains unclear. Exploitation requires local code execution as the LOCAL SERVICE account, which is typically granted to Windows services. Once that foothold is achieved, the attacker can elevate privileges to SYSTEM by changing the VEN configuration. Attackers with this sub‑elevation can execute commands with full system rights, potentially compromising data confidentiality, integrity, and availability on the host.