CVE-2026-11846: IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion

Synopsis

Arbitrary file deletion vulnerability in IEI Integration Corp's iVEC-IEI Virtualization Edge Computer allows an authenticated remote attacker to delete arbitrary files and directories on the system. The attacker reaches the vulnerable service over the network and requires a low-privilege account; no victim interaction is needed. Successful exploitation enables destruction of system data or disruption of running services. A patched-image rebuild at version 1.0.4 is available on HarborGuard for environments running an affected version of iVEC TANK-XM811.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iVEC-IEI management interface over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed.

• AuthenticationRequired

  A valid low-privilege account is sufficient to trigger the vulnerability; the CVSS vector specifies PR:L, so unauthenticated access alone does not enable exploitation.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the vulnerability entirely on their own once authenticated.

• Attack complexityDetail

  The exploit is reliable and condition-free; the CVSS vector specifies AC:L, meaning no race conditions or special environmental factors are required.

Blast Radius

• Attacker deletes arbitrary files or directories on the target system, including critical operating system or application files.
• Deletion of key system files causes service disruption or renders the virtualization edge computer inoperable.
• Persistent data stored on the device, such as configuration files or workload state, is permanently destroyed with no recovery path if backups are absent.