CrowdStrike released security updates for a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. The vulnerability exists in a cluster API endpoint that allows remote attackers to read arbitrary files without authentication. Next-Gen SIEM customers are not affected. CrowdStrike deployed network-layer blocks for SaaS customers on April 7, 2026, and found no evidence of exploitation. Self-hosted customers must upgrade immediately. The vulnerability was discovered during internal product testing.