CVE-2026-24166

MediumCVSS 5.1/10Last modified Aug 28, 2026

Description

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
NVIDIAUnified Fabric Manager Enterprise - GAAll GA versions prior to 6.24.1-5
NVIDIAUnified Fabric Manager Enterprise - LTS 2025All LTS versions prior to 6.23.20-3
NVIDIAUnified Fabric Manager Enterprise - LTS 2024All LTS versions prior to 6.19.15
NVIDIAUnified Fabric Manager Enterprise - LTS 2023All LTS versions prior to 6.15.17

References

Timeline

Published
Aug 25, 2026
Last modified
Aug 28, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-241676.8NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands CVE-2026-241686.8NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may causeCVE-2026-241698.0NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject coCVE-2026-24179.3A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow aCVE-2026-241708.8NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause impropeCVE-2026-241737.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sCVE-2026-241747.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sCVE-2026-241757.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tCVE-2026-241764.3NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. ACVE-2026-241777.7NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of thCVE-2026-241789.8NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cauCVE-2026-24189.1The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unau
CVE-2026-24166: Medium severity, CVSS 5.1 | Vulnix