CVE-2026-24169: Command Injection
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with low privileges can exploit it by sending a specially crafted request to the plugin management API. No user interaction is required.
What access does an attacker need?
The attack vector is adjacent network access, and the attacker must first authenticate with a low-privileged account. The available data does not indicate that unauthenticated remote exploitation is possible.
What could a successful attack allow?
Successful exploitation may allow code execution, privilege escalation, and disclosure of information. Confidentiality, integrity, and availability impacts are all rated high.